Query: Sigma rule for Detects the creation of a named pipe with a pattern found in CobaltStrike malleable C2 profiles
Matching passage: Sigma rule: Detects the creation of a named pipe with a pattern found in CobaltStrike malleable C2 profiles. Logsource: windows / pipe_created. Rule: title: CobaltStrike Named Pipe Patterns id: 85adeb13-4fc9-4e68-8a4a-c7cb2c336eb7 related: - id: 0e7163d4-9e19-4fa7-9be6-000c61aad77a type: similar - id: d5601f8c-b26f-4ab0-9035-69e11a8d4ad2 type: similar status: test description: Detects the creation of a named pipe with a pattern found in CobaltStrike malleable C2 profiles references: - https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575 - https://gist.github.com/MHaggis/6c600e524045a6d49c35291a21e10752 author: Florian Roth (Nextron Systems), Christian Burkard (Nextron Systems) date: 2021-07-30 modified: 2024-01-26 tags: - attack.privilege-escalation - attack.stealth - attack.t1055 - stp.1k logsource: product: windows category: pipe_created definition: Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can always use Cobalt Strike, but also you can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575 detection: selection_malleable_profile_generic: - PipeName|startswith: - \DserNamePipe - \f4c3 - \f53f - \fullduplex_ - \mojo.5688.8052.183894939787088877 - \mojo.5688.8052.35780273329370473 - \MsFteWds - \msrpc_ - \mypipe-f - \mypipe-h - \ntsvcs - \PGMessagePipe - \rpc_ - \scerpc - \SearchTextHarvester - \spoolss - \win_svc - \win\msrpc_ - \windows.update.manager - \wkssvc - PipeName: - \demoagent_11 - \demoagent_22 selection_malleable_profile_catalog_change_listener: PipeName|startswith: \Winsock2\CatalogChangeListener- PipeName|endswith: -0, filter_main_generic: PipeName: - \wkssvc - \spoolss - \scerpc - \ntsvcs - \SearchTextHarvester - \PGMessagePipe - \MsFteWds filter_optional_websense: Image|contains: - :\Program Files\Websense\ - :\Program Files (x86)\Websense\ PipeName|startswith: - \DserNamePipeR - \DserNamePipeW condition: 1 of selection_malleable_profile_* and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Chrome instances using the exact same pipe name "mojo.xxx" - Websense Endpoint usin
Near-miss passage: Sigma rule: Detects external disk drives or plugged-in USB devices.. Logsource: windows / security. Rule: title: External Disk Drive Or USB Storage Device Was Recognized By The System id: f69a87ea-955e-4fb4-adb2-bb9fd6685632 status: test description: Detects external disk drives or plugged-in USB devices. references: - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-6416 author: Keith Wright date: 2019-11-20 modified: 2024-02-09 tags: - attack.t1091 - attack.t1200 - attack.lateral-movement - attack.initial-access logsource: product: windows service: security detection: selection_eid: EventID: 6416 selection_field: - ClassName: DiskDrive - DeviceDescription: USB Mass Storage Device condition: all of selection_* falsepositives: - Likely level: low