deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Potential Persistence Via App Paths Default Property
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-10
ATT&CK techniques: T1546.012
Log source: windows/registry_set

Description:
Detects changes to the "Default" property for keys located in the \Software\Microsoft\Windows\CurrentVersion\App Paths\ registry. Which might be used as a method of persistence
The entries found under App Paths are used primarily for the following purposes.
First, to map an application's executable file name to that file's fully qualified path.
Second, to prepend information to the PATH environment variable on a per-application, per-process basis.


Detection logic:
{
  "selection": {
    "TargetObject|contains": "\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths",
    "TargetObject|endswith": [
      "(Default)",
      "Path"
    ],
    "Details|contains": [
      "\\Users\\Public",
      "\\AppData\\Local\\Temp\\",
      "\\Windows\\Temp\\",
      "\\Desktop\\",
      "\\Downloads\\",
      "%temp%",
      "%tmp%",
      "iex",
      "Invoke-",
      "rundll32",
      "regsvr32",
      "mshta",
      "cscript",
      "wscript",
      ".bat",
      ".hta",
      ".dll",
      ".ps1"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.hexacorn.com/blog/2013/01/19/beyond-good-ol-run-key-part-3/
  - https://learn.microsoft.com/en-us/windows/win32/shell/app-registration
Sigma Detection Rule: UAC Bypass via Sdclt
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Omer Yampel, Christian Burkard (Nextron Systems)
Date: 2017-03-17
ATT&CK techniques: T1548.002
Log source: windows/registry_set

Description:
Detects the pattern of UAC Bypass using registry key manipulation of sdclt.exe (e.g. UACMe 53)

Detection logic:
{
  "selection1": {
    "TargetObject|endswith": "Software\\Classes\\exefile\\shell\\runas\\command\\isolatedCommand"
  },
  "selection2": {
    "TargetObject|endswith": "Software\\Classes\\Folder\\shell\\open\\command\\SymbolicLinkValue",
    "Details|re": "-1[0-9]{3}\\\\Software\\\\Classes\\\\"
  },
  "condition": "1 of selection*"
}

References:
  - https://enigma0x3.net/2017/03/17/fileless-uac-bypass-using-sdclt-exe/
  - https://github.com/hfiref0x/UACME
Sigma Detection Rule: Potential COM Object Hijacking Via TreatAs Subkey - Registry
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Kutepov Anton, oscd.community
Date: 2019-10-23
ATT&CK techniques: T1546.015
Log source: windows/registry_set

Description:
Detects COM object hijacking via TreatAs subkey

Detection logic:
{
  "selection": {
    "TargetObject|contains|all": [
      "HKU\\",
      "Classes\\CLSID\\",
      "\\TreatAs"
    ]
  },
  "filter_main_svchost": {
    "Image": "C:\\WINDOWS\\system32\\svchost.exe"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://bohops.com/2018/08/18/abusing-the-com-registry-structure-part-2-loading-techniques-for-evasion-and-persistence/
Sigma Detection Rule: New BgInfo.EXE Custom DB Path Registry Configuration
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-08-16
ATT&CK techniques: T1112
Log source: windows/registry_set

Description:
Detects setting of a new registry database value related to BgInfo configuration. Attackers can for example set this value to save the results of the commands executed by BgInfo in order to exfiltrate information.

Detection logic:
{
  "selection": {
    "TargetObject|endswith": "\\Software\\Winternals\\BGInfo\\Database"
  },
  "condition": "selection"
}

References:
  - Internal Research
Sigma Detection Rule: Registry Persistence via Explorer Run Key
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), oscd.community
Date: 2018-07-18
ATT&CK techniques: T1547.001
Log source: windows/registry_set

Description:
Detects a possible persistence mechanism using RUN key for Windows Explorer and pointing to a suspicious folder

Detection logic:
{
  "selection": {
    "TargetObject|endswith": "\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run",
    "Details|contains": [
      ":\\$Recycle.bin\\",
      ":\\ProgramData\\",
      ":\\Temp\\",
      ":\\Users\\Default\\",
      ":\\Users\\Public\\",
      ":\\Windows\\Temp\\",
      "\\AppData\\Local\\Temp\\"
    ]
  },
  "condition": "selection"
}

References:
  - https://researchcenter.paloaltonetworks.com/2018/07/unit42-upatre-continues-evolve-new-anti-analysis-techniques/
Sigma Detection Rule: Potential WerFault ReflectDebugger Registry Value Abuse
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: X__Junior
Date: 2023-05-18
ATT&CK techniques: T1036.003
Log source: windows/registry_set

Description:
Detects potential WerFault "ReflectDebugger" registry value abuse for persistence.

Detection logic:
{
  "selection": {
    "TargetObject|endswith": "\\Microsoft\\Windows\\Windows Error Reporting\\Hangs\\ReflectDebugger"
  },
  "condition": "selection"
}

References:
  - https://cocomelonc.github.io/malware/2022/11/02/malware-pers-18.html
  - https://www.hexacorn.com/blog/2018/08/31/beyond-good-ol-run-key-part-85/
Sigma Detection Rule: MaxMpxCt Registry Value Changed
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2024-03-19
ATT&CK techniques: T1070.005
Log source: windows/registry_set

Description:
Detects changes to the "MaxMpxCt" registry value.
MaxMpxCt specifies the maximum outstanding network requests for the server per client, which is used when negotiating a Server Message Block (SMB) connection with a client. Note if the value is set beyond 125 older Windows 9x clients will fail to negotiate.
Ransomware threat actors and operators (specifically BlackCat) were seen increasing this value in order to handle a higher volume of traffic.


Detection logic:
{
  "selection": {
    "TargetObject|endswith": "\\Services\\LanmanServer\\Parameters\\MaxMpxCt"
  },
  "condition": "selection"
}

References:
  - https://www.huntress.com/blog/blackcat-ransomware-affiliate-ttps
  - https://securityscorecard.com/research/deep-dive-into-alphv-blackcat-ransomware
  - https://www.intrinsec.com/alphv-ransomware-gang-analysis/?cn-reloaded=1
  - https://www.sentinelone.com/labs/blackcat-ransomware-highly-configurable-rust-driven-raas-on-the-prowl-for-victims/
Sigma Detection Rule: PUA - Sysinternal Tool Execution - Registry
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Markus Neis
Date: 2017-08-28
ATT&CK techniques: T1588.002
Log source: windows/registry_set

Description:
Detects the execution of a Sysinternals Tool via the creation of the "accepteula" registry key

Detection logic:
{
  "selection": {
    "TargetObject|endswith": "\\EulaAccepted"
  },
  "condition": "selection"
}

References:
  - https://twitter.com/Moti_B/status/[PII_REDACTED]35035392
Sigma Detection Rule: Default RDP Port Changed to Non Standard Port
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113
Date: 2022-01-01
ATT&CK techniques: T1547.010
Log source: windows/registry_set

Description:
Detects changes to the default RDP port.
Remote desktop is a common feature in operating systems. It allows a user to log into a remote system using an interactive session with a graphical user interface.
Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS).


Detection logic:
{
  "selection": {
    "TargetObject|endswith": "\\Control\\Terminal Server\\WinStations\\RDP-Tcp\\PortNumber"
  },
  "filter_main_port": {
    "Details": "DWORD (0x00000d3d)"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1021.001/T1021.001.md
Sigma Detection Rule: Windows Hypervisor Enforced Code Integrity Disabled
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), Anish Bogati
Date: 2023-03-14
ATT&CK techniques: T1685
Log source: windows/registry_set

Description:
Detects changes to the HypervisorEnforcedCodeIntegrity registry key and the "Enabled" value being set to 0 in order to disable the Hypervisor Enforced Code Integrity feature. This allows an attacker to load unsigned and untrusted code to be run in the kernel


Detection logic:
{
  "selection": {
    "TargetObject|endswith": [
      "\\Control\\DeviceGuard\\HypervisorEnforcedCodeIntegrity",
      "\\Control\\DeviceGuard\\Scenarios\\HypervisorEnforcedCodeIntegrity\\Enabled",
      "\\Microsoft\\Windows\\DeviceGuard\\HypervisorEnforcedCodeIntegrity"
    ],
    "Details": "DWORD (0x00000000)"
  },
  "condition": "selection"
}

References:
  - https://www.welivesecurity.com/2023/03/01/blacklotus-uefi-bootkit-myth-confirmed/
  - https://github.com/redcanaryco/atomic-red-team/blob/04e487c1828d76df3e834621f4f893ea756d5232/atomics/T1562.001/T1562.001.md#atomic-test-43---disable-hypervisor-enforced-code-integrity-hvci
Sigma Detection Rule: Alternate PowerShell Hosts Pipe
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Roberto Rodriguez @Cyb3rWard0g, Tim Shelton
Date: 2019-09-12
ATT&CK techniques: T1059.001
Log source: windows/pipe_created

Description:
Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe

Detection logic:
{
  "selection": {
    "PipeName|startswith": "\\PSHost"
  },
  "filter_main_generic": [
    {
      "Image|contains": [
        ":\\Program Files\\PowerShell\\7-preview\\pwsh.exe",
        ":\\Program Files\\PowerShell\\7\\pwsh.exe",
        ":\\Windows\\system32\\dsac.exe",
        ":\\Windows\\system32\\inetsrv\\w3wp.exe",
        ":\\Windows\\System32\\sdiagnhost.exe",
        ":\\Windows\\system32\\ServerManager.exe",
        ":\\Windows\\system32\\wbem\\wmiprvse.exe",
        ":\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell_ise.exe",
        ":\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe",
        ":\\Windows\\System32\\wsmprovhost.exe",
        ":\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell_ise.exe",
        ":\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe"
      ]
    },
    {
      "Image|contains|all": [
        "C:\\Program Files\\WindowsApps\\Microsoft.PowerShellPreview",
        "\\pwsh.exe"
      ]
    },
    {
      "Image|contains|all": [
        "\\AppData\\Local\\Microsoft\\WindowsApps\\Microsoft.PowerShellPreview",
        "\\pwsh.exe"
      ]
    }
  ],
  "filter_optional_sqlserver": {
    "Image|startswith": [
      "C:\\Program Files (x86)\\",
      "C:\\Program Files\\"
    ],
    "Image|contains": "\\Microsoft SQL Server\\",
    "Image|endswith": "\\Tools\\Binn\\SQLPS.exe"
  },
  "filter_optional_azure_connected_machine_agent": {
    "Image|startswith": "C:\\Program Files\\AzureConnectedMachineAgent\\

References:
  - https://threathunterplaybook.com/hunts/windows/190610-PwshAlternateHosts/notebook.html
  - https://threathunterplaybook.com/hunts/windows/190410-LocalPwshExecution/notebook.html
Sigma Detection Rule: HackTool - CoercedPotato Named Pipe Creation
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2023-10-11
ATT&CK techniques: T1055
Log source: windows/pipe_created

Description:
Detects the pattern of a pipe name as used by the hack tool CoercedPotato

Detection logic:
{
  "selection": {
    "PipeName|contains": "\\coerced\\"
  },
  "condition": "selection"
}

References:
  - https://blog.hackvens.fr/articles/CoercedPotato.html
  - https://github.com/hackvens/CoercedPotato
Sigma Detection Rule: CobaltStrike Named Pipe
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Florian Roth (Nextron Systems), Wojciech Lesicki
Date: 2021-05-25
ATT&CK techniques: T1055
Log source: windows/pipe_created

Description:
Detects the creation of a named pipe as used by CobaltStrike

Detection logic:
{
  "selection_MSSE": {
    "PipeName|contains|all": [
      "\\MSSE-",
      "-server"
    ]
  },
  "selection_postex": {
    "PipeName|startswith": "\\postex_"
  },
  "selection_status": {
    "PipeName|startswith": "\\status_"
  },
  "selection_msagent": {
    "PipeName|startswith": "\\msagent_"
  },
  "selection_mojo": {
    "PipeName|startswith": "\\mojo_"
  },
  "selection_interprocess": {
    "PipeName|startswith": "\\interprocess_"
  },
  "selection_samr": {
    "PipeName|startswith": "\\samr_"
  },
  "selection_netlogon": {
    "PipeName|startswith": "\\netlogon_"
  },
  "selection_srvsvc": {
    "PipeName|startswith": "\\srvsvc_"
  },
  "selection_lsarpc": {
    "PipeName|startswith": "\\lsarpc_"
  },
  "selection_wkssvc": {
    "PipeName|startswith": "\\wkssvc_"
  },
  "condition": "1 of selection*"
}

References:
  - https://twitter.com/d4rksystem/status/[PII_REDACTED]64873472
  - https://labs.f-secure.com/blog/detecting-cobalt-strike-default-modules-via-named-pipe-analysis/
  - https://github.com/SigmaHQ/sigma/issues/253
  - https://blog.cobaltstrike.com/2021/02/09/learn-pipe-fitting-for-all-of-your-offense-projects/
  - https://redcanary.com/threat-detection-report/threats/cobalt-strike/
Sigma Detection Rule: ADFS Database Named Pipe Connection By Uncommon Tool
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Roberto Rodriguez @Cyb3rWard0g
Date: 2021-10-08
ATT&CK techniques: T1005
Log source: windows/pipe_created

Description:
Detects suspicious local connections via a named pipe to the AD FS configuration database (Windows Internal Database).
Used to access information such as the AD FS configuration settings which contains sensitive information used to sign SAML tokens.


Detection logic:
{
  "selection": {
    "PipeName": "\\MICROSOFT##WID\\tsql\\query"
  },
  "filter_main_generic": {
    "Image|endswith": [
      ":\\Windows\\System32\\mmc.exe",
      ":\\Windows\\system32\\svchost.exe",
      ":\\Windows\\System32\\wsmprovhost.exe",
      ":\\Windows\\SysWOW64\\mmc.exe",
      ":\\Windows\\SysWOW64\\wsmprovhost.exe",
      ":\\Windows\\WID\\Binn\\sqlwriter.exe",
      "\\AzureADConnect.exe",
      "\\Microsoft.Identity.Health.Adfs.PshSurrogate.exe",
      "\\Microsoft.IdentityServer.ServiceHost.exe",
      "\\Microsoft.Tri.Sensor.exe",
      "\\sqlservr.exe",
      "\\tssdis.exe"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://github.com/Azure/Azure-Sentinel/blob/f99542b94afe0ad2f19a82cc08262e7ac8e1428e/Detections/SecurityEvent/ADFSDBNamedPipeConnection.yaml
  - https://o365blog.com/post/adfs/
  - https://github.com/Azure/SimuLand
Sigma Detection Rule: CobaltStrike Named Pipe Pattern Regex
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-07-30
ATT&CK techniques: T1055
Log source: windows/pipe_created

Description:
Detects the creation of a named pipe matching a pattern used by CobaltStrike Malleable C2 profiles

Detection logic:
{
  "selection": [
    {
      "PipeName|re": "\\\\mojo\\.5688\\.8052\\.(?:[PII_REDACTED]7088877|[PII_REDACTED]9370473)[0-9a-f]{2}"
    },
    {
      "PipeName|re": "\\\\wkssvc_?[0-9a-f]{2}"
    },
    {
      "PipeName|re": "\\\\ntsvcs[0-9a-f]{2}"
    },
    {
      "PipeName|re": "\\\\DserNamePipe[0-9a-f]{2}"
    },
    {
      "PipeName|re": "\\\\SearchTextHarvester[0-9a-f]{2}"
    },
    {
      "PipeName|re": "\\\\mypipe-(?:f|h)[0-9a-f]{2}"
    },
    {
      "PipeName|re": "\\\\windows\\.update\\.manager[0-9a-f]{2,3}"
    },
    {
      "PipeName|re": "\\\\ntsvcs_[0-9a-f]{2}"
    },
    {
      "PipeName|re": "\\\\scerpc_?[0-9a-f]{2}"
    },
    {
      "PipeName|re": "\\\\PGMessagePipe[0-9a-f]{2}"
    },
    {
      "PipeName|re": "\\\\MsFteWds[0-9a-f]{2}"
    },
    {
      "PipeName|re": "\\\\f4c3[0-9a-f]{2}"
    },
    {
      "PipeName|re": "\\\\fullduplex_[0-9a-f]{2}"
    },
    {
      "PipeName|re": "\\\\msrpc_[0-9a-f]{4}"
    },
    {
      "PipeName|re": "\\\\win\\\\msrpc_[0-9a-f]{2}"
    },
    {
      "PipeName|re": "\\\\f53f[0-9a-f]{2}"
    },
    {
      "PipeName|re": "\\\\rpc_[0-9a-f]{2}"
    },
    {
      "PipeName|re": "\\\\spoolss_[0-9a-f]{2}"
    },
    {
      "PipeName|re": "\\\\Winsock2\\\\CatalogChangeListener-[0-9a-f]{3}-0,"
    }
  ],
  "condition": "selection"
}

References:
  - https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575
  - https://gist.github.com/MHaggis/6c600e524045a6d49c35291a21e10752
Sigma Detection Rule: Malicious Named Pipe Created
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Florian Roth (Nextron Systems), blueteam0ps, elhoim
Date: 2017-11-06
ATT&CK techniques: T1055
Log source: windows/pipe_created

Description:
Detects the creation of a named pipe seen used by known APTs or malware.

Detection logic:
{
  "selection": {
    "PipeName": [
      "\\46a676ab7f179e511e30dd2dc41bd388",
      "\\583da945-62af-10e8-4902-a8f205c72b2e",
      "\\6e7645c4-32c5-4fe3-aabf-e94c2f4370e7",
      "\\9f81f59bc[PII_REDACTED]4ce513865ed20",
      "\\adschemerpc",
      "\\ahexec",
      "\\AnonymousPipe",
      "\\bc31a7",
      "\\bc367",
      "\\bizkaz",
      "\\csexecsvc",
      "\\dce_3d",
      "\\e710f28d59aa529d6792ca6ff0ca1b34",
      "\\gruntsvc",
      "\\isapi_dg",
      "\\isapi_dg2",
      "\\isapi_http",
      "\\jaccdpqnvbrrxlaf",
      "\\lsassw",
      "\\NamePipe_MoreWindows",
      "\\pcheap_reuse",
      "\\Posh*",
      "\\rpchlp_3",
      "\\sdlrpc",
      "\\svcctl",
      "\\testPipe",
      "\\winsession"
    ]
  },
  "condition": "selection"
}

References:
  - https://securelist.com/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/71275/
  - https://securelist.com/faq-the-projectsauron-apt/75533/
  - https://web.archive.org/web/[PII_REDACTED]3601/https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf
  - https://www.us-cert.gov/ncas/alerts/TA17-117A
  - https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html
Sigma Detection Rule: HackTool - Credential Dumping Tools Named Pipe Created
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Teymur Kheirkhabarov, oscd.community
Date: 2019-11-01
ATT&CK techniques: T1003.001, T1003.002, T1003.004, T1003.005
Log source: windows/pipe_created

Description:
Detects well-known credential dumping tools execution via specific named pipe creation

Detection logic:
{
  "selection": {
    "PipeName|contains": [
      "\\cachedump",
      "\\lsadump",
      "\\wceservicepipe"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
  - https://image.slidesharecdn.com/zeronights2017kheirkhabarov[PII_REDACTED]00/75/hunting-for-credentials-dumping-in-windows-environment-57-2048.jpg?cb=[PII_REDACTED]
Sigma Detection Rule: PsExec Tool Execution From Suspicious Locations - PipeName
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-04
ATT&CK techniques: T1569.002
Log source: windows/pipe_created

Description:
Detects PsExec default pipe creation where the image executed is located in a suspicious location. Which could indicate that the tool is being used in an attack

Detection logic:
{
  "selection": {
    "PipeName": "\\PSEXESVC",
    "Image|contains": [
      ":\\Users\\Public\\",
      ":\\Windows\\Temp\\",
      "\\AppData\\Local\\Temp\\",
      "\\Desktop\\",
      "\\Downloads\\"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.jpcert.or.jp/english/pub/sr/ir_research.html
  - https://jpcertcc.github.io/ToolAnalysisResultSheet
Sigma Detection Rule: PUA - RemCom Default Named Pipe
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nikita Nazarov, oscd.community, Nasreddine Bencherchali (Nextron Systems)
Date: 2023-08-07
ATT&CK techniques: T1021.002, T1569.002
Log source: windows/pipe_created

Description:
Detects default RemCom pipe creation

Detection logic:
{
  "selection": {
    "PipeName|contains": "\\RemCom"
  },
  "condition": "selection"
}

References:
  - https://drive.google.com/file/d/1lKya3_mLnR3UQuCoiYruO3qgu052_iS_/view
  - https://github.com/kavika13/RemCom
Sigma Detection Rule: HackTool - DiagTrackEoP Default Named Pipe
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-03
Log source: windows/pipe_created

Description:
Detects creation of default named pipe used by the DiagTrackEoP POC, a tool that abuses "SeImpersonate" privilege.

Detection logic:
{
  "selection": {
    "PipeName|contains": "thisispipe"
  },
  "condition": "selection"
}

References:
  - https://github.com/Wh04m1001/DiagTrackEoP/blob/3a2fc99c9700623eb7dc7d4b5f314fd9ce5ef51f/main.cpp#L22
Sigma Detection Rule: HackTool - Koh Default Named Pipe
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-07-08
ATT&CK techniques: T1528, T1134.001
Log source: windows/pipe_created

Description:
Detects creation of default named pipes used by the Koh tool

Detection logic:
{
  "selection": {
    "PipeName|contains": [
      "\\imposecost",
      "\\imposingcost"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/GhostPack/Koh/blob/0283d9f3f91cf74732ad377821986cfcb088e20a/Clients/BOF/KohClient.c#L12
Sigma Detection Rule: CobaltStrike Named Pipe Patterns
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), Christian Burkard (Nextron Systems)
Date: 2021-07-30
ATT&CK techniques: T1055
Log source: windows/pipe_created

Description:
Detects the creation of a named pipe with a pattern found in CobaltStrike malleable C2 profiles

Detection logic:
{
  "selection_malleable_profile_generic": [
    {
      "PipeName|startswith": [
        "\\DserNamePipe",
        "\\f4c3",
        "\\f53f",
        "\\fullduplex_",
        "\\mojo.5688.8[PII_REDACTED][PII_REDACTED]7",
        "\\mojo.5688.8[PII_REDACTED][PII_REDACTED]",
        "\\MsFteWds",
        "\\msrpc_",
        "\\mypipe-f",
        "\\mypipe-h",
        "\\ntsvcs",
        "\\PGMessagePipe",
        "\\rpc_",
        "\\scerpc",
        "\\SearchTextHarvester",
        "\\spoolss",
        "\\win_svc",
        "\\win\\msrpc_",
        "\\windows.update.manager",
        "\\wkssvc"
      ]
    },
    {
      "PipeName": [
        "\\demoagent_11",
        "\\demoagent_22"
      ]
    }
  ],
  "selection_malleable_profile_catalog_change_listener": {
    "PipeName|startswith": "\\Winsock2\\CatalogChangeListener-",
    "PipeName|endswith": "-0,"
  },
  "filter_main_generic": {
    "PipeName": [
      "\\wkssvc",
      "\\spoolss",
      "\\scerpc",
      "\\ntsvcs",
      "\\SearchTextHarvester",
      "\\PGMessagePipe",
      "\\MsFteWds"
    ]
  },
  "filter_optional_websense": {
    "Image|contains": [
      ":\\Program Files\\Websense\\",
      ":\\Program Files (x86)\\Websense\\"
    ],
    "PipeName|startswith": [
      "\\DserNamePipeR",
      "\\DserNamePipeW"
    ]
  },
  "condition": "1 of selection_malleable_profile_* and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575
  - https://gist.github.com/MHaggis/6c600e524045a6d49c35291a21e10752
Sigma Detection Rule: New PowerShell Instance Created
Repository: SigmaHQ/sigma
Severity: informational
Status: test
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
Date: 2019-09-12
ATT&CK techniques: T1059.001
Log source: windows/pipe_created

Description:
Detects the execution of PowerShell via the creation of a named pipe starting with PSHost

Detection logic:
{
  "selection": {
    "PipeName|startswith": "\\PSHost"
  },
  "condition": "selection"
}

References:
  - https://threathunterplaybook.com/hunts/windows/190610-PwshAlternateHosts/notebook.html
  - https://threathunterplaybook.com/hunts/windows/190410-LocalPwshExecution/notebook.html