Query: detection rule: Detects the creation of a named pipe as used by CobaltStrike
Matching passage: Sigma rule: Detects the creation of a named pipe as used by CobaltStrike. Logsource: windows / pipe_created. Rule: title: CobaltStrike Named Pipe id: d5601f8c-b26f-4ab0-9035-69e11a8d4ad2 related: - id: 85adeb13-4fc9-4e68-8a4a-c7cb2c336eb7 type: similar - id: 0e7163d4-9e19-4fa7-9be6-000c61aad77a type: similar status: test description: Detects the creation of a named pipe as used by CobaltStrike references: - https://twitter.com/d4rksystem/status/1357010969264873472 - https://labs.f-secure.com/blog/detecting-cobalt-strike-default-modules-via-named-pipe-analysis/ - https://github.com/SigmaHQ/sigma/issues/253 - https://blog.cobaltstrike.com/2021/02/09/learn-pipe-fitting-for-all-of-your-offense-projects/ - https://redcanary.com/threat-detection-report/threats/cobalt-strike/ author: Florian Roth (Nextron Systems), Wojciech Lesicki date: 2021-05-25 modified: 2022-10-31 tags: - attack.privilege-escalation - attack.stealth - attack.t1055 logsource: product: windows category: pipe_created definition: Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can always use Cobalt Strike, but also you can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575 detection: selection_MSSE: PipeName|contains|all: - \MSSE- - -server selection_postex: PipeName|startswith: \postex_ selection_status: PipeName|startswith: \status_ selection_msagent: PipeName|startswith: \msagent_ selection_mojo: PipeName|startswith: \mojo_ selection_interprocess: PipeName|startswith: \interprocess_ selection_samr: PipeName|startswith: \samr_ selection_netlogon: PipeName|startswith: \netlogon_ selection_srvsvc: PipeName|startswith: \srvsvc_ selection_lsarpc: PipeName|startswith: \lsarpc_ selection_wkssvc: PipeName|startswith: \wkssvc_ condition: 1 of selection* falsepositives: - Unknown level: critical
Near-miss passage: Sigma rule: Detects when a Microsoft Cloud App Security reported suspicious email forwarding rules, for example, if a user created a. Logsource: m365 / threat_management. Rule: title: Suspicious Inbox Forwarding id: 6c220477-0b5b-4b25-bb90-66183b4089e8 status: test description: Detects when a Microsoft Cloud App Security reported suspicious email forwarding rules, for example, if a user created an inbox rule that forwards a copy of all emails to an external address. references: - https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy - https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference author: Austin Songer @austinsonger date: 2021-08-22 modified: 2022-10-09 tags: - attack.exfiltration - attack.t1020 logsource: service: threat_management product: m365 detection: selection: eventSource: SecurityComplianceCenter eventName: Suspicious inbox forwarding status: success condition: selection falsepositives: - Unknown level: low