CobaltStrike Named Pipe Patterns
Detects the creation of a named pipe with a pattern found in CobaltStrike malleable C2 profiles
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Definition
Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can always use Cobalt Strike, but also you can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575
detection:
selection_malleable_profile_generic:
- PipeName|startswith:
- '\DserNamePipe'
- '\f4c3'
- '\f53f'
- '\fullduplex_'
- '\mojo.5688.8052.183894939787088877'
- '\mojo.5688.8052.35780273329370473'
- '\MsFteWds'
- '\msrpc_'
- '\mypipe-f'
- '\mypipe-h'
- '\ntsvcs'
- '\PGMessagePipe'
- '\rpc_'
- '\scerpc'
- '\SearchTextHarvester'
- '\spoolss'
- '\win_svc'
- '\win\msrpc_'
- '\windows.update.manager'
- '\wkssvc'
- PipeName:
- '\demoagent_11'
- '\demoagent_22'
selection_malleable_profile_catalog_change_listener:
PipeName|startswith: '\Winsock2\CatalogChangeListener-'
PipeName|endswith: '-0,'
filter_main_generic:
PipeName:
- '\wkssvc'
- '\spoolss'
- '\scerpc'
- '\ntsvcs'
- '\SearchTextHarvester'
- '\PGMessagePipe'
- '\MsFteWds'
filter_optional_websense:
Image|contains:
- ':\Program Files\Websense\'
- ':\Program Files (x86)\Websense\'
PipeName|startswith:
- '\DserNamePipeR'
- '\DserNamePipeW'
condition: 1 of selection_malleable_profile_* and not 1 of filter_main_* and not 1 of filter_optional_*Chrome instances using the exact same pipe name "mojo.xxx"
Websense Endpoint using the pipe name "DserNamePipe(R|W)\d{1,5}"
Techniques
Other
CobaltStrike Named Pipe Pattern Regex
Detects the creation of a named pipe matching a pattern used by CobaltStrike Malleable C2 profiles
Detects similar activity. Both rules may fire on overlapping events.
CobaltStrike Named Pipe
Detects the creation of a named pipe as used by CobaltStrike
Detects similar activity. Both rules may fire on overlapping events.