Windows Named Pipe Creation: PsExec Default Pipe \PSEXESVC

title: "Windows Named Pipe Creation: PsExec Default Pipe \\PSEXESVC"
id: 8e96463b-3cb1-45cc-ae99-91dcc9082fbf
related:
  - id: 42c575ea-e41e-41f1-b248-8093c3e82a28
    type: derived
  - id: f3f3a972-f982-40ad-b63c-bca6afdfad7c
    type: derived
status: test
description: This rule flags creation of a Windows named pipe with the specific pipe name "\\PSEXESVC", associated with PsExec’s default service pipe. Attackers can use PsExec to execute remote commands, and named pipe activity can provide a high-fidelity indicator of that behavior. It relies on telemetry that records named pipe creation events (e.g., Sysmon named pipe events).
references:
  - https://www.jpcert.or.jp/english/pub/sr/ir_research.html
  - https://jpcertcc.github.io/ToolAnalysisResultSheet
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/pipe_created/pipe_created_sysinternals_psexec_default_pipe.yml
author: Thomas Patzke, Huntrule Team
date: 2017-06-12
modified: 2022-10-09
tags:
  - attack.execution
  - attack.t1569.002
  - attack.s0029
  - detection.threat-hunting
logsource:
  category: pipe_created
  product: windows
  definition: Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575
detection:
  selection:
    PipeName: \PSEXESVC
  condition: selection
falsepositives:
  - Unknown
level: low
license: DRL-1.1