Query: Sigma YAML for windows / pipe_created
Matching passage: Sigma rule: Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe. Logsource: windows / pipe_created. Rule: title: Alternate PowerShell Hosts Pipe id: 58cb02d5-78ce-4692-b3e1-dce850aae41a related: - id: ac7102b4-9e1e-4802-9b4f-17c5524c015c type: derived status: test description: Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe references: - https://threathunterplaybook.com/hunts/windows/190610-PwshAlternateHosts/notebook.html - https://threathunterplaybook.com/hunts/windows/190410-LocalPwshExecution/notebook.html author: Roberto Rodriguez @Cyb3rWard0g, Tim Shelton date: 2019-09-12 modified: 2025-10-07 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: pipe_created definition: Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575 detection: selection: PipeName|startswith: \PSHost filter_main_generic: - Image|contains: - :\Program Files\PowerShell\7-preview\pwsh.exe - :\Program Files\PowerShell\7\pwsh.exe - :\Windows\system32\dsac.exe - :\Windows\system32\inetsrv\w3wp.exe - :\Windows\System32\sdiagnhost.exe - :\Windows\system32\ServerManager.exe - :\Windows\system32\wbem\wmiprvse.exe - :\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe - :\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - :\Windows\System32\wsmprovhost.exe - :\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe - :\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe - Image|contains|all: - C:\Program Files\WindowsApps\Microsoft.PowerShellPreview - \pwsh.exe - Image|contains|all: - \AppData\Local\Microsoft\WindowsApps\Microsoft.PowerShellPreview - \pwsh.exe filter_optional_sqlserver: Image|startswith: - C:\Program Files (x86)\ - C:\Program Files\ Image|contains: \Microsoft SQL Server\ Image|endswith: \Tools\Binn\SQLPS.exe filter_optional_azure_connected_machine_agent: Image|startswith: C:\Program Files\AzureConnectedMachineAgent\GCArcService Image|endswith: \GC\gc_worker.exe filter_optional_citrix: Image|startswith: C:\Program Files\Citrix\ filter_optional_exchange: Image|startswith: C:\Program Files\Microsoft\Exchange Se
Near-miss passage: Sigma rule: Detects the use of the Windows Update Client binary (wuauclt.exe) to proxy execute code and making network connections.. Logsource: windows / network_connection. Rule: title: Potentially Suspicious Wuauclt Network Connection id: c649a6c7-cd8c-4a78-9c04-000fc76df954 status: test description: 'Detects the use of the Windows Update Client binary (wuauclt.exe) to proxy execute code and making network connections. One could easily make the DLL spawn a new process and inject to it to proxy the network connection and bypass this rule. ' references: - https://dtm.uk/wuauclt/ author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2020-10-12 modified: 2024-03-12 tags: - attack.stealth - attack.t1218 logsource: category: network_connection product: windows definition: 'Requirements: The CommandLine field enrichment is required in order for this rule to be used.' detection: selection: Image|contains: wuauclt CommandLine|contains: ' /RunHandlerComServer' filter_main_ip: DestinationIp|cidr: - 127.0.0.0/8 - 10.0.0.0/8 - 169.254.0.0/16 - 172.16.0.0/12 - 192.168.0.0/16 - ::1/128 - fe80::/10 - fc00::/7 filter_main_msrange: DestinationIp|cidr: - 20.184.0.0/13 - 20.192.0.0/10 - 23.79.0.0/16 - 51.10.0.0/15 - 51.103.0.0/16 - 51.104.0.0/15 - 52.224.0.0/11 filter_main_uus: CommandLine|contains: - :\Windows\UUS\Packages\Preview\amd64\updatedeploy.dll /ClassId - :\Windows\UUS\amd64\UpdateDeploy.dll /ClassId filter_main_winsxs: CommandLine|contains|all: - :\Windows\WinSxS\ - '\UpdateDeploy.dll /ClassId ' filter_main_cli_null: CommandLine: null filter_main_cli_empty: CommandLine: '' condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium