Windows Named Pipe Creation by Known Malware Pipe Names

title: Windows Named Pipe Creation by Known Malware Pipe Names
id: cb075cc7-926e-4d1f-b1ee-6775b77ffbf5
status: test
description: This rule flags Windows systems when a named pipe is created with a PipeName matching a list associated with known malware and APT tooling. Named pipes can be used for stealthy inter-process communication and command/control mechanisms, so matching these specific pipe names helps surface suspicious activity. It relies on telemetry from Windows pipe creation events (e.g., Sysmon Event ID 17/18) that capture the PipeName value.
references:
  - https://securelist.com/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/71275/
  - https://securelist.com/faq-the-projectsauron-apt/75533/
  - https://web.archive.org/web/20180725233601/https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf
  - https://www.us-cert.gov/ncas/alerts/TA17-117A
  - https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html
  - https://thedfirreport.com/2020/06/21/snatch-ransomware/
  - https://github.com/RiccardoAncarani/LiquidSnake
  - https://www.accenture.com/us-en/blogs/cyber-defense/turla-belugasturgeon-compromises-government-entity
  - https://us-cert.cisa.gov/ncas/analysis-reports/ar19-304a
  - https://download.bitdefender.com/resources/files/News/CaseStudies/study/115/Bitdefender-Whitepaper-PAC-A4-en-EN1.pdf
  - https://unit42.paloaltonetworks.com/emissary-panda-attacks-middle-east-government-sharepoint-servers/
  - https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/pipe_created/pipe_created_susp_malicious_namedpipes.yml
author: Florian Roth (Nextron Systems), blueteam0ps, elhoim, Huntrule Team
date: 2017-11-06
modified: 2023-08-07
tags:
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1055
logsource:
  product: windows
  category: pipe_created
  definition: Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575
detection:
  selection:
    PipeName:
      - \46a676ab7f179e511e30dd2dc41bd388
      - \583da945-62af-10e8-4902-a8f205c72b2e
      - \6e7645c4-32c5-4fe3-aabf-e94c2f4370e7
      - \9f81f59bc58452127884ce513865ed20
      - \adschemerpc
      - \ahexec
      - \AnonymousPipe
      - \bc31a7
      - \bc367
      - \bizkaz
      - \csexecsvc
      - \dce_3d
      - \e710f28d59aa529d6792ca6ff0ca1b34
      - \gruntsvc
      - \isapi_dg
      - \isapi_dg2
      - \isapi_http
      - \jaccdpqnvbrrxlaf
      - \lsassw
      - \NamePipe_MoreWindows
      - \pcheap_reuse
      - \Posh*
      - \rpchlp_3
      - \sdlrpc
      - \svcctl
      - \testPipe
      - \winsession
  condition: selection
falsepositives:
  - Unknown
level: critical
license: DRL-1.1
related:
  - id: fe3ac066-98bb-432a-b1e7-a5229cb39d4a
    type: derived