Windows: Detect Koh default named pipe creation by pipe name

title: "Windows: Detect Koh default named pipe creation by pipe name"
id: fb5e2fa3-f95c-4bf5-b7bc-b42b63d4f243
status: test
description: This rule flags the creation of named pipes whose names contain the Koh default pipe identifiers "\imposecost" or "\imposingcost". Creating these pipes can indicate installation or staging of tooling that relies on named pipes for local inter-process communication and stealth. It relies on Windows named pipe creation telemetry (e.g., Sysmon pipe events) that includes the PipeName value.
references:
  - https://github.com/GhostPack/Koh/blob/0283d9f3f91cf74732ad377821986cfcb088e20a/Clients/BOF/KohClient.c#L12
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/pipe_created/pipe_created_hktl_koh_default_pipe.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-07-08
modified: 2023-08-07
tags:
  - attack.privilege-escalation
  - attack.credential-access
  - attack.stealth
  - attack.t1528
  - attack.t1134.001
logsource:
  product: windows
  category: pipe_created
  definition: Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575
detection:
  selection:
    PipeName|contains:
      - \imposecost
      - \imposingcost
  condition: selection
falsepositives:
  - Unlikely
level: critical
license: DRL-1.1
related:
  - id: 0adc67e0-a68f-4ffd-9c43-28905aad5d6a
    type: derived