Sigma rule: ADFS Database Named Pipe Connection By Uncommon Tool

Rule

Title

ADFS Database Named Pipe Connection By Uncommon Tool

Status

test

Level

medium

Author

Roberto Rodriguez @Cyb3rWard0g

Date

2021-10-08

Modified

2023-11-30

File

rules/windows/pipe_created/pipe_created_adfs_namedpipe_connection_uncommon_tool.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects suspicious local connections via a named pipe to the AD FS configuration database (Windows Internal Database).
Used to access information such as the AD FS configuration settings which contains sensitive information used to sign SAML tokens.

Log source

product

windows

category

pipe_created

definition

Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575

Detection

selection:
    PipeName: '\MICROSOFT##WID\tsql\query'
filter_main_generic:
    Image|endswith:
        - ':\Windows\System32\mmc.exe'
        - ':\Windows\system32\svchost.exe'
        - ':\Windows\System32\wsmprovhost.exe'
        - ':\Windows\SysWOW64\mmc.exe'
        - ':\Windows\SysWOW64\wsmprovhost.exe'
        - ':\Windows\WID\Binn\sqlwriter.exe'
        - '\AzureADConnect.exe'
        - '\Microsoft.Identity.Health.Adfs.PshSurrogate.exe'
        - '\Microsoft.IdentityServer.ServiceHost.exe'
        - '\Microsoft.Tri.Sensor.exe'
        - '\sqlservr.exe'
        - '\tssdis.exe'
condition: selection and not 1 of filter_main_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.collection
• attack.t1005

MITRE ATT&CK ids this rule names

• T1005

References

• https://github.com/Azure/Azure-Sentinel/blob/f99542b94afe0ad2f19a82cc08262e7ac8e1428e/Detections/SecurityEvent/ADFSDBNamedPipeConnection.yaml
• https://o365blog.com/post/adfs/
• https://github.com/Azure/SimuLand

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/pipe_created/pipe_created_adfs_namedpipe_connection_uncommon_tool.yml