Query: rule covering Detects the creation of a named pipe seen used by known APTs or malware.
Matching passage: Sigma rule: Detects the creation of a named pipe seen used by known APTs or malware.. Logsource: windows / pipe_created. Rule: title: Malicious Named Pipe Created id: fe3ac066-98bb-432a-b1e7-a5229cb39d4a status: test description: Detects the creation of a named pipe seen used by known APTs or malware. references: - https://securelist.com/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/71275/ - https://securelist.com/faq-the-projectsauron-apt/75533/ - https://web.archive.org/web/20180725233601/https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf - https://www.us-cert.gov/ncas/alerts/TA17-117A - https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html - https://thedfirreport.com/2020/06/21/snatch-ransomware/ - https://github.com/RiccardoAncarani/LiquidSnake - https://www.accenture.com/us-en/blogs/cyber-defense/turla-belugasturgeon-compromises-government-entity - https://us-cert.cisa.gov/ncas/analysis-reports/ar19-304a - https://download.bitdefender.com/resources/files/News/CaseStudies/study/115/Bitdefender-Whitepaper-PAC-A4-en-EN1.pdf - https://unit42.paloaltonetworks.com/emissary-panda-attacks-middle-east-government-sharepoint-servers/ - https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/ author: Florian Roth (Nextron Systems), blueteam0ps, elhoim date: 2017-11-06 modified: 2023-08-07 tags: - attack.privilege-escalation - attack.stealth - attack.t1055 logsource: product: windows category: pipe_created definition: Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575 detection: selection: PipeName: - \46a676ab7f179e511e30dd2dc41bd388 - \583da945-62af-10e8-4902-a8f205c72b2e - \6e7645c4-32c5-4fe3-aabf-e94c2f4370e7 - \9f81f59bc58452127884ce513865ed20 - \adschemerpc - \ahexec - \AnonymousPipe - \bc31a7 - \bc367 - \bizkaz - \csexecsvc - \dce_3d - \e710f28d59aa529d6792ca6ff0ca1b34 - \gruntsvc - \isapi_dg - \isapi_dg2 - \isapi_http - \jaccdpqnvbrrxlaf - \lsassw - \NamePipe_MoreWindows - \pcheap_reuse - \Posh* - \rpchlp_3 - \sdlrpc - \svcctl - \testPipe -
Near-miss passage: Sigma rule: Detects modification to the "Default" value of the "MyComputer" key and subkeys to point to a custom binary that will be. Logsource: windows / registry_set. Rule: title: Potential Persistence Via MyComputer Registry Keys id: 8fbe98a8-8f9d-44f8-aa71-8c572e29ef06 status: test description: Detects modification to the "Default" value of the "MyComputer" key and subkeys to point to a custom binary that will be launched whenever the associated action is executed (see reference section for example) references: - https://www.hexacorn.com/blog/2017/01/18/beyond-good-ol-run-key-part-55/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-09 modified: 2024-01-11 tags: - attack.persistence logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \Microsoft\Windows\CurrentVersion\Explorer\MyComputer TargetObject|endswith: (Default) condition: selection falsepositives: - Unlikely but if you experience FPs add specific processes and locations you would like to monitor for level: high