Phoenix
Sigma IntelligenceBeta
Back to Rules
Detectionhightest

NtdllPipe Like Activity Execution

Detects command that type the content of ntdll.dll to a different file or a pipe in order to evade AV / EDR detection. As seen being used in the POC NtdllPipe

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
Florian Roth (Nextron Systems)Created Sat Mar 05Updated Tue Mar 07bbc865e4-7fcd-45a6-8ff1-95ced28ec5b2windows
Log Source
WindowsProcess Creation
ProductWindows← raw: windows
CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic
Detection Logic1 selector
detection:
    selection:
        CommandLine|contains:
            - 'type %windir%\system32\ntdll.dll'
            - 'type %systemroot%\system32\ntdll.dll'
            - 'type c:\windows\system32\ntdll.dll'
            - '\\ntdll.dll > \\\\.\\pipe\\'
    condition: selection
False Positives
Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

References
1
Resolving title…
web.archive.org
MITRE ATT&CK
Rule Metadata
Rule ID
bbc865e4-7fcd-45a6-8ff1-95ced28ec5b2
Status
test
Level
high
Type
Detection
Created
Sat Mar 05
Modified
Tue Mar 07
Author
Florian Roth (Nextron Systems)
Path
rules/windows/process_creation/proc_creation_win_cmd_ntdllpipe_redirect.yml
Raw Tags
attack.defense-evasion
View on GitHub