Query: alert when Detects the creation of a named pipe seen used by known APTs or malware.
Matching passage: Sigma rule: Detects the creation of a named pipe seen used by known APTs or malware.. Logsource: windows / pipe_created. Rule: title: Malicious Named Pipe Created id: fe3ac066-98bb-432a-b1e7-a5229cb39d4a status: test description: Detects the creation of a named pipe seen used by known APTs or malware. references: - https://securelist.com/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/71275/ - https://securelist.com/faq-the-projectsauron-apt/75533/ - https://web.archive.org/web/20180725233601/https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf - https://www.us-cert.gov/ncas/alerts/TA17-117A - https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html - https://thedfirreport.com/2020/06/21/snatch-ransomware/ - https://github.com/RiccardoAncarani/LiquidSnake - https://www.accenture.com/us-en/blogs/cyber-defense/turla-belugasturgeon-compromises-government-entity - https://us-cert.cisa.gov/ncas/analysis-reports/ar19-304a - https://download.bitdefender.com/resources/files/News/CaseStudies/study/115/Bitdefender-Whitepaper-PAC-A4-en-EN1.pdf - https://unit42.paloaltonetworks.com/emissary-panda-attacks-middle-east-government-sharepoint-servers/ - https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/ author: Florian Roth (Nextron Systems), blueteam0ps, elhoim date: 2017-11-06 modified: 2023-08-07 tags: - attack.privilege-escalation - attack.stealth - attack.t1055 logsource: product: windows category: pipe_created definition: Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575 detection: selection: PipeName: - \46a676ab7f179e511e30dd2dc41bd388 - \583da945-62af-10e8-4902-a8f205c72b2e - \6e7645c4-32c5-4fe3-aabf-e94c2f4370e7 - \9f81f59bc58452127884ce513865ed20 - \adschemerpc - \ahexec - \AnonymousPipe - \bc31a7 - \bc367 - \bizkaz - \csexecsvc - \dce_3d - \e710f28d59aa529d6792ca6ff0ca1b34 - \gruntsvc - \isapi_dg - \isapi_dg2 - \isapi_http - \jaccdpqnvbrrxlaf - \lsassw - \NamePipe_MoreWindows - \pcheap_reuse - \Posh* - \rpchlp_3 - \sdlrpc - \svcctl - \testPipe -
Near-miss passage: Sigma rule: Detects cmd.exe executing commands with the "start" utility using "/b" (no window) or "/min" (minimized) flags. To reduc. Logsource: windows / process_creation. Rule: title: Cmd Launched with Hidden Start Flags to Suspicious Targets id: 5a6b7c8d-9e0f-1a2b-3c4d-5e6f7a8b9c0d status: experimental description: 'Detects cmd.exe executing commands with the "start" utility using "/b" (no window) or "/min" (minimized) flags. To reduce false positives from standard background tasks, detection is restricted to scenarios where the target is a known script extension or located in suspicious temporary/public directories. This technique was observed in Chaos, DarkSide, and Emotet malware campaigns. ' references: - https://www.fortinet.com/blog/threat-research/evolution-of-chaos-ransomware-faster-smarter-and-more-dangerous - https://www.fortinet.com/blog/threat-research/newly-discovered-function-in-darkside-ransomware-variant-targets-disk-partitions - https://www.fortinet.com/blog/threat-research/ms-office-files-involved-in-emotet-trojan-campaign-pt-one - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/start tags: - attack.stealth - attack.t1564.003 author: Vladan Sekulic, Swachchhanda Shrawan Poudel (Nextron Systems) date: 2026-01-24 logsource: category: process_creation product: windows detection: selection_cmd_img: - Image|endswith: \cmd.exe - OriginalFileName: Cmd.Exe selection_cmd_hidden_start_1: CommandLine|contains|windash: - 'start ' - start/b - start/min selection_cmd_hidden_start_2: CommandLine|contains|windash: - '/b ' - /b" - '/min ' - /min" selection_cli_uncommon_location: CommandLine|contains: - :\Perflogs\ - :\Temp\ - :\Users\Default\ - :\Windows\Temp\ - \AppData\Roaming\ - \Contacts\ - \Documents\ - \Downloads\ - \Favorites\ - \Favourites\ - \inetpub\ - \Music\ - \Photos\ - \Temporary Internet\ - \Users\Public\ - \Videos\ selection_cli_susp_extension: CommandLine|contains: - .bat - .cmd - .cpl - .hta - .js - .ps1 - .scr - .vbe - .vbs selection_cli_susp_pattern: CommandLine|contains: - ' -nop ' - ' -sta ' - .downloadfile( - .downloadstring( - '-noni ' - '-w hidden ' condition: all of selection_cmd_* and 1 of selection_cli_* falsepositives: - Legitimate administrative scripts running from temporary folders. - Niche software updaters utilizing hidden batch files in ProgramData. level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_cmd_launched_with_hidden_start_flag/info.yml