Query: write Sigma for Detects the creation of a named pipe with a pattern found in CobaltStrike malleable C2 profiles
Matching passage: Sigma rule: Detects the creation of a named pipe with a pattern found in CobaltStrike malleable C2 profiles. Logsource: windows / pipe_created. Rule: title: CobaltStrike Named Pipe Patterns id: 85adeb13-4fc9-4e68-8a4a-c7cb2c336eb7 related: - id: 0e7163d4-9e19-4fa7-9be6-000c61aad77a type: similar - id: d5601f8c-b26f-4ab0-9035-69e11a8d4ad2 type: similar status: test description: Detects the creation of a named pipe with a pattern found in CobaltStrike malleable C2 profiles references: - https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575 - https://gist.github.com/MHaggis/6c600e524045a6d49c35291a21e10752 author: Florian Roth (Nextron Systems), Christian Burkard (Nextron Systems) date: 2021-07-30 modified: 2024-01-26 tags: - attack.privilege-escalation - attack.stealth - attack.t1055 - stp.1k logsource: product: windows category: pipe_created definition: Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can always use Cobalt Strike, but also you can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575 detection: selection_malleable_profile_generic: - PipeName|startswith: - \DserNamePipe - \f4c3 - \f53f - \fullduplex_ - \mojo.5688.8052.183894939787088877 - \mojo.5688.8052.35780273329370473 - \MsFteWds - \msrpc_ - \mypipe-f - \mypipe-h - \ntsvcs - \PGMessagePipe - \rpc_ - \scerpc - \SearchTextHarvester - \spoolss - \win_svc - \win\msrpc_ - \windows.update.manager - \wkssvc - PipeName: - \demoagent_11 - \demoagent_22 selection_malleable_profile_catalog_change_listener: PipeName|startswith: \Winsock2\CatalogChangeListener- PipeName|endswith: -0, filter_main_generic: PipeName: - \wkssvc - \spoolss - \scerpc - \ntsvcs - \SearchTextHarvester - \PGMessagePipe - \MsFteWds filter_optional_websense: Image|contains: - :\Program Files\Websense\ - :\Program Files (x86)\Websense\ PipeName|startswith: - \DserNamePipeR - \DserNamePipeW condition: 1 of selection_malleable_profile_* and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Chrome instances using the exact same pipe name "mojo.xxx" - Websense Endpoint usin
Near-miss passage: Sigma rule: Detects a DNS server error in which a specified plugin DLL (in registry) could not be loaded. Logsource: windows / dns-server. Rule: title: DNS Server Error Failed Loading the ServerLevelPluginDLL id: cbe51394-cd93-4473-b555-edf0144952d9 related: - id: e61e8a88-59a9-451c-874e-70fcc9740d67 type: derived - id: f63b56ee-3f79-4b8a-97fb-5c48007e8573 type: derived status: test description: Detects a DNS server error in which a specified plugin DLL (in registry) could not be loaded references: - https://medium.com/@esnesenon/feature-not-bug-dnsadmin-to-dc-compromise-in-one-line-a0f779b8dc83 - https://technet.microsoft.com/en-us/library/cc735829(v=ws.10).aspx - https://twitter.com/gentilkiwi/status/861641945944391680 author: Florian Roth (Nextron Systems) date: 2017-05-08 modified: 2023-02-05 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1574.001 logsource: product: windows service: dns-server detection: selection: EventID: - 150 - 770 - 771 condition: selection falsepositives: - Unknown level: high