Query: write Sigma for Detects the creation of a named pipe as used by CobaltStrike
Matching passage: Sigma rule: Detects the creation of a named pipe as used by CobaltStrike. Logsource: windows / pipe_created. Rule: title: CobaltStrike Named Pipe id: d5601f8c-b26f-4ab0-9035-69e11a8d4ad2 related: - id: 85adeb13-4fc9-4e68-8a4a-c7cb2c336eb7 type: similar - id: 0e7163d4-9e19-4fa7-9be6-000c61aad77a type: similar status: test description: Detects the creation of a named pipe as used by CobaltStrike references: - https://twitter.com/d4rksystem/status/1357010969264873472 - https://labs.f-secure.com/blog/detecting-cobalt-strike-default-modules-via-named-pipe-analysis/ - https://github.com/SigmaHQ/sigma/issues/253 - https://blog.cobaltstrike.com/2021/02/09/learn-pipe-fitting-for-all-of-your-offense-projects/ - https://redcanary.com/threat-detection-report/threats/cobalt-strike/ author: Florian Roth (Nextron Systems), Wojciech Lesicki date: 2021-05-25 modified: 2022-10-31 tags: - attack.privilege-escalation - attack.stealth - attack.t1055 logsource: product: windows category: pipe_created definition: Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can always use Cobalt Strike, but also you can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575 detection: selection_MSSE: PipeName|contains|all: - \MSSE- - -server selection_postex: PipeName|startswith: \postex_ selection_status: PipeName|startswith: \status_ selection_msagent: PipeName|startswith: \msagent_ selection_mojo: PipeName|startswith: \mojo_ selection_interprocess: PipeName|startswith: \interprocess_ selection_samr: PipeName|startswith: \samr_ selection_netlogon: PipeName|startswith: \netlogon_ selection_srvsvc: PipeName|startswith: \srvsvc_ selection_lsarpc: PipeName|startswith: \lsarpc_ selection_wkssvc: PipeName|startswith: \wkssvc_ condition: 1 of selection* falsepositives: - Unknown level: critical
Near-miss passage: Sigma rule: Detects SMB server connections to shares without signing or encryption enabled. This could indicate potential lateral mo. Logsource: windows / smbserver-connectivity. Rule: title: Unsigned or Unencrypted SMB Connection to Share Established id: 8d91f6e4-9f3b-4c21-ae41-2c5b7d9f7a12 status: experimental description: 'Detects SMB server connections to shares without signing or encryption enabled. This could indicate potential lateral movement activity using unsecured SMB shares. ' author: Mohamed Abdelghani date: 2025-10-19 references: - https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/overview-server-message-block-signing tags: - attack.lateral-movement - attack.t1021.002 logsource: product: windows service: smbserver-connectivity detection: selection_shares: EventID: 4000 ShareName|contains: - IPC$ - ADMIN$ - C$ selection_status: - SigningUsed: 'false' - EncyptionUsed: 'false' filter_main_local_ips: - ClientAddress|cidr: - 127.0.0.0/8 - 169.254.0.0/16 - ::1/128 - fe80::/10 - fc00::/7 - ClientAddress|contains: - '00000000000000000000000000000001' - FE80000000000000 - FC00000000000000 - 0200????7F - 0200????A9FE condition: all of selection_* and not 1 of filter_main_* falsepositives: - Connections from local or private IP addresses to SMB shares without signing or encryption enabled for older systems or misconfigured environments. Apply additional tuning as needed. level: medium