Windows: Detect PAExec default named pipe creation via Sysmon

title: "Windows: Detect PAExec default named pipe creation via Sysmon"
id: fd3b2b18-0fc4-44ed-9541-120af0211106
status: test
description: This rule flags creation of Windows named pipes whose name starts with "\PAExec", matching the PAExec default named pipe behavior. Attackers may use this mechanism to enable remote command execution or process control through inter-process communication channels. The detection relies on named pipe creation telemetry, typically from Sysmon event data for pipe creation (e.g., Event ID 17/18) with the pipe name present.
references:
  - https://github.com/microsoft/Microsoft-365-Defender-Hunting-Queries/blob/efa17a600b43c897b4b7463cc8541daa1987eeb4/Command%20and%20Control/C2-NamedPipe.md
  - https://github.com/poweradminllc/PAExec
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/pipe_created/pipe_created_pua_paexec_default_pipe.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-10-26
tags:
  - attack.execution
  - attack.t1569.002
logsource:
  category: pipe_created
  product: windows
  definition: Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575
detection:
  selection:
    PipeName|startswith: \PAExec
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: f6451de4-df0a-41fa-8d72-b39f54a08db5
    type: derived