Windows Named Pipe Creation Indicating Credential Dumping Tools

Alerts on Windows named pipe creations matching credential dumping tool pipe names.

FreeUnreviewedSigmacriticalv1

windows-named-pipe-creation-indicating-credential-dumping-tools-961d0ba2

title: Windows Named Pipe Creation Indicating Credential Dumping Tools
id: 9ae03bc0-0ecf-4754-bbb2-c8e9eee76b32
status: test
description: This rule identifies Windows events where a named pipe is created with names associated with well-known credential dumping utilities ("\\cachedump", "\\lsadump", and "\\wceservicepipe"). Attackers may use these pipes as IPC mechanisms to trigger or coordinate credential dumping activity. The detection relies on telemetry for named pipe creation events that include the PipeName field, such as Sysmon pipe created logs.
references:
  - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
  - https://image.slidesharecdn.com/zeronights2017kheirkhabarov-171118103000/75/hunting-for-credentials-dumping-in-windows-environment-57-2048.jpg?cb=1666035799
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/pipe_created/pipe_created_hktl_generic_cred_dump_tools_pipes.yml
author: Teymur Kheirkhabarov, oscd.community, Huntrule Team
date: 2019-11-01
modified: 2023-08-07
tags:
  - attack.credential-access
  - attack.t1003.001
  - attack.t1003.002
  - attack.t1003.004
  - attack.t1003.005
logsource:
  product: windows
  category: pipe_created
  definition: Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575
detection:
  selection:
    PipeName|contains:
      - \cachedump
      - \lsadump
      - \wceservicepipe
  condition: selection
falsepositives:
  - Legitimate Administrator using tool for password recovery
level: critical
license: DRL-1.1
related:
  - id: 961d0ba2-3eea-4303-a930-2cf78bbfcc5e
    type: derived

What it detects

This rule identifies Windows events where a named pipe is created with names associated with well-known credential dumping utilities ("\\cachedump", "\\lsadump", and "\\wceservicepipe"). Attackers may use these pipes as IPC mechanisms to trigger or coordinate credential dumping activity. The detection relies on telemetry for named pipe creation events that include the PipeName field, such as Sysmon pipe created logs.

Known false positives

Legitimate Administrator using tool for password recovery

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.