Sigma rule: CobaltStrike Named Pipe Patterns

Rule

Title

CobaltStrike Named Pipe Patterns

Status

test

Level

high

Author

Florian Roth (Nextron Systems), Christian Burkard (Nextron Systems)

Date

2021-07-30

Modified

2024-01-26

File

rules/windows/pipe_created/pipe_created_hktl_cobaltstrike_susp_pipe_patterns.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the creation of a named pipe with a pattern found in CobaltStrike malleable C2 profiles

Log source

product

windows

category

pipe_created

definition

Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can always use Cobalt Strike, but also you can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575

Detection

selection_malleable_profile_generic:
    - PipeName|startswith:
          - '\DserNamePipe'
          - '\f4c3'
          - '\f53f'
          - '\fullduplex_'
          - '\mojo.5688.8052.183894939787088877'
          - '\mojo.5688.8052.35780273329370473'
          - '\MsFteWds'
          - '\msrpc_'
          - '\mypipe-f'
          - '\mypipe-h'
          - '\ntsvcs'
          - '\PGMessagePipe'
          - '\rpc_'
          - '\scerpc'
          - '\SearchTextHarvester'
          - '\spoolss'
          - '\win_svc'
          - '\win\msrpc_'
          - '\windows.update.manager'
          - '\wkssvc'
    - PipeName:
          - '\demoagent_11'
          - '\demoagent_22'
selection_malleable_profile_catalog_change_listener:
    PipeName|startswith: '\Winsock2\CatalogChangeListener-'
    PipeName|endswith: '-0,'
filter_main_generic:
    PipeName:
        - '\wkssvc'
        - '\spoolss'
        - '\scerpc'
        - '\ntsvcs'
        - '\SearchTextHarvester'
        - '\PGMessagePipe'
        - '\MsFteWds'
filter_optional_websense:
    Image|contains:
        - ':\Program Files\Websense\'
        - ':\Program Files (x86)\Websense\'
    PipeName|startswith:
        - '\DserNamePipeR'
        - '\DserNamePipeW'
condition: 1 of selection_malleable_profile_* and not 1 of filter_main_* and not 1 of filter_optional_*

False positives (as the rule lists them)

• Chrome instances using the exact same pipe name "mojo.xxx"
• Websense Endpoint using the pipe name "DserNamePipe(R|W)\d{1,5}"
• Some applications may just coincidentally use the pipe names which contain the same prefix as the ones used by CobaltStrike, e.g. "f4c3"

Tags

• attack.privilege-escalation
• attack.stealth
• attack.t1055
• stp.1k

MITRE ATT&CK ids this rule names

• T1055

Related rules

• 0e7163d4-9e19-4fa7-9be6-000c61aad77a (similar)
• d5601f8c-b26f-4ab0-9035-69e11a8d4ad2 (similar)

References

• https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575
• https://gist.github.com/MHaggis/6c600e524045a6d49c35291a21e10752

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/pipe_created/pipe_created_hktl_cobaltstrike_susp_pipe_patterns.yml