Windows Named Pipe Creation for Known Credential Dumping Tool Pipe Names
Alerts on Windows named pipe creations matching credential dumping tool pipe names.
- Product
- windows
- Category
- pipe_created
- Author
- Teymur Kheirkhabarov, oscd.community (SigmaHQ), DRL 1.1
- Published
- 2019-11-01
- Updated
- 2026-07-31
ATT&CK techniques
Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies Windows named pipe creation events where the pipe name contains specific strings associated with well-known credential dumping tools. Attackers may use named pipes to transfer data or coordinate execution during credential access, making these pipe names valuable indicators of malicious activity. It relies on telemetry from Windows pipe creation logging (e.g., Sysmon named pipe events) capturing the created pipe name.
Reporting behind it
- slideshare.nethttps://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
- image.slidesharecdn.comhttps://image.slidesharecdn.com/zeronights2017kheirkhabarov-171118103000/75/hunting-for-credentials-dumping-in-windows-environment-57-2048.jpg?cb=1666035799
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/pipe_created/pipe_created_hktl_generic_cred_dump_tools_pipes.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Named Pipe Creation for Known Credential Dumping Tool Pipe Names
id: 9ae03bc0-0ecf-4754-bbb2-c8e9eee76b32
status: test
description: This rule identifies Windows named pipe creation events where the pipe name contains specific strings associated with well-known credential dumping tools. Attackers may use named pipes to transfer data or coordinate execution during credential access, making these pipe names valuable indicators of malicious activity. It relies on telemetry from Windows pipe creation logging (e.g., Sysmon named pipe events) capturing the created pipe name.
references:
- https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
- https://image.slidesharecdn.com/zeronights2017kheirkhabarov-171118103000/75/hunting-for-credentials-dumping-in-windows-environment-57-2048.jpg?cb=1666035799
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/pipe_created/pipe_created_hktl_generic_cred_dump_tools_pipes.yml
author: Teymur Kheirkhabarov, oscd.community, Huntrule Team
date: 2019-11-01
modified: 2023-08-07
tags:
- attack.credential-access
- attack.t1003.001
- attack.t1003.002
- attack.t1003.004
- attack.t1003.005
logsource:
product: windows
category: pipe_created
definition: Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575
detection:
selection:
PipeName|contains:
- \cachedump
- \lsadump
- \wceservicepipe
condition: selection
falsepositives:
- Legitimate Administrator using tool for password recovery
level: critical
license: DRL-1.1
related:
- id: 961d0ba2-3eea-4303-a930-2cf78bbfcc5e
type: derived