Sigma rule: Malicious Named Pipe Created

Rule

Title

Malicious Named Pipe Created

Status

test

Level

critical

Author

Florian Roth (Nextron Systems), blueteam0ps, elhoim

Date

2017-11-06

Modified

2023-08-07

File

rules/windows/pipe_created/pipe_created_susp_malicious_namedpipes.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the creation of a named pipe seen used by known APTs or malware.

Log source

product

windows

category

pipe_created

definition

Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575

Detection

selection:
    PipeName:
        - '\46a676ab7f179e511e30dd2dc41bd388'  # Project Sauron
        - '\583da945-62af-10e8-4902-a8f205c72b2e'  # SolarWinds SUNBURST malware
        - '\6e7645c4-32c5-4fe3-aabf-e94c2f4370e7'  # LiquidSnake
        - '\9f81f59bc58452127884ce513865ed20'  # Project Sauron
        - '\adschemerpc'  # Turla HyperStack
        - '\ahexec'  # Sofacy group malware
        - '\AnonymousPipe'  # Hidden Cobra Hoplight
        - '\bc31a7'  # Pacifier
        - '\bc367'  # Pacifier
        - '\bizkaz'  # Snatch Ransomware
        - '\csexecsvc' # CSEXEC default
        - '\dce_3d' # Qbot
        - '\e710f28d59aa529d6792ca6ff0ca1b34'  # Project Sauron
        - '\gruntsvc' # Covenant default
        - '\isapi_dg'  # Uroburos Malware
        - '\isapi_dg2'  # Uroburos Malware
        - '\isapi_http'  # Uroburos Malware
        - '\jaccdpqnvbrrxlaf' # PoshC2 default
        - '\lsassw'  # Wild Neutron APT malware
        - '\NamePipe_MoreWindows'  # Cloud Hopper - RedLeaves
        - '\pcheap_reuse'  # Pipe used by Equation Group malware
        - '\Posh*' # PoshC2 default
        - '\rpchlp_3'  # Project Sauron
        - '\sdlrpc'  # Cobra Trojan
        - '\svcctl' # Crackmapexec smbexec default
        - '\testPipe'  # Emissary Panda Hyperbro
        - '\winsession'  # Wild Neutron APT malware
        # - '\status_*' # CS default  https://github.com/SigmaHQ/sigma/issues/253
condition: selection

False positives (as the rule lists them)

• Unknown

Tags

• attack.privilege-escalation
• attack.stealth
• attack.t1055

MITRE ATT&CK ids this rule names

• T1055

References

• https://securelist.com/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/71275/
• https://securelist.com/faq-the-projectsauron-apt/75533/
• https://web.archive.org/web/20180725233601/https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf
• https://www.us-cert.gov/ncas/alerts/TA17-117A
• https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html
• https://thedfirreport.com/2020/06/21/snatch-ransomware/
• https://github.com/RiccardoAncarani/LiquidSnake
• https://www.accenture.com/us-en/blogs/cyber-defense/turla-belugasturgeon-compromises-government-entity
• https://us-cert.cisa.gov/ncas/analysis-reports/ar19-304a
• https://download.bitdefender.com/resources/files/News/CaseStudies/study/115/Bitdefender-Whitepaper-PAC-A4-en-EN1.pdf
• https://unit42.paloaltonetworks.com/emissary-panda-attacks-middle-east-government-sharepoint-servers/
• https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/pipe_created/pipe_created_susp_malicious_namedpipes.yml