CobaltStrike Named Pipe

Title: CobaltStrike Named Pipe
Status: test
Description:Detects the creation of a named pipe as used by CobaltStrike
References:
  -https://twitter.com/d4rksystem/status/1357010969264873472
  -https://labs.f-secure.com/blog/detecting-cobalt-strike-default-modules-via-named-pipe-analysis/
  -https://github.com/SigmaHQ/sigma/issues/253
  -https://blog.cobaltstrike.com/2021/02/09/learn-pipe-fitting-for-all-of-your-offense-projects/
  -https://redcanary.com/threat-detection-report/threats/cobalt-strike/
Author: Florian Roth (Nextron Systems), Wojciech Lesicki
Date: 2021-05-25
modified:2022-10-31
Tags:

• -'attack.privilege-escalation'
• -'attack.stealth'
• -'attack.t1055'

Logsource:

• product: windows
• category: pipe_created
• definition: Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can always use Cobalt Strike, but also you can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575

Detection:
  selection_MSSE:
    PipeName|contains|all:
      -'\MSSE-'
      -'-server'

  selection_postex:
    PipeName|startswith: '\postex_'
  selection_status:
    PipeName|startswith: '\status_'
  selection_msagent:
    PipeName|startswith: '\msagent_'
  selection_mojo:
    PipeName|startswith: '\mojo_'
  selection_interprocess:
    PipeName|startswith: '\interprocess_'
  selection_samr:
    PipeName|startswith: '\samr_'
  selection_netlogon:
    PipeName|startswith: '\netlogon_'
  selection_srvsvc:
    PipeName|startswith: '\srvsvc_'
  selection_lsarpc:
    PipeName|startswith: '\lsarpc_'
  selection_wkssvc:
    PipeName|startswith: '\wkssvc_'
  condition:1 of selection*
Falsepositives:
  -Unknown
Level: critical