Windows Named Pipe Creation Matching Suspected Turla Pipe Names
Alert on Windows named pipe creation when the PipeName matches Turla-associated strings.
- Product
- windows
- Category
- pipe_created
- Author
- Markus Neis (SigmaHQ), DRL 1.1
- Published
- 2017-11-06
- Updated
- 2026-07-31
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows named pipe creation events where the pipe name matches a small set of specific strings associated with Turla group samples. Attackers can use named pipes for local inter-process communication and to stage or proxy payload components, making unusual pipe creation a useful indicator. It relies on telemetry from Windows named pipe events (e.g., Sysmon pipe creation events) that expose the created PipeName value.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Named Pipe Creation Matching Suspected Turla Pipe Names
id: f740dddf-1d03-46d1-9821-0f5e95db95b5
status: test
description: This rule flags Windows named pipe creation events where the pipe name matches a small set of specific strings associated with Turla group samples. Attackers can use named pipes for local inter-process communication and to stage or proxy payload components, making unusual pipe creation a useful indicator. It relies on telemetry from Windows named pipe events (e.g., Sysmon pipe creation events) that expose the created PipeName value.
references:
- Internal Research
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2017/TA/Turla/pipe_created_apt_turla_named_pipes.yml
author: Markus Neis, Huntrule Team
date: 2017-11-06
modified: 2021-11-27
tags:
- attack.g0010
- attack.execution
- attack.t1106
- detection.emerging-threats
logsource:
product: windows
category: pipe_created
definition: Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575
detection:
selection:
PipeName:
- \atctl
- \comnap
- \iehelper
- \sdlrpc
- \userpipe
condition: selection
falsepositives:
- Unlikely
level: critical
license: DRL-1.1
related:
- id: 739915e4-1e70-4778-8b8a-17db02f66db1
type: derived