Malicious Named Pipe Created

Title: Malicious Named Pipe Created
Status: test
Description:Detects the creation of a named pipe seen used by known APTs or malware.
References:
  -https://securelist.com/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/71275/
  -https://securelist.com/faq-the-projectsauron-apt/75533/
  -https://web.archive.org/web/20180725233601/https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf
  -https://www.us-cert.gov/ncas/alerts/TA17-117A
  -https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html
  -https://thedfirreport.com/2020/06/21/snatch-ransomware/
  -https://github.com/RiccardoAncarani/LiquidSnake
  -https://www.accenture.com/us-en/blogs/cyber-defense/turla-belugasturgeon-compromises-government-entity
  -https://us-cert.cisa.gov/ncas/analysis-reports/ar19-304a
  -https://download.bitdefender.com/resources/files/News/CaseStudies/study/115/Bitdefender-Whitepaper-PAC-A4-en-EN1.pdf
  -https://unit42.paloaltonetworks.com/emissary-panda-attacks-middle-east-government-sharepoint-servers/
  -https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/
Author: Florian Roth (Nextron Systems), blueteam0ps, elhoim
Date: 2017-11-06
modified:2023-08-07
Tags:

• -'attack.privilege-escalation'
• -'attack.stealth'
• -'attack.t1055'

Logsource:

• product: windows
• category: pipe_created
• definition: Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575

Detection:
  selection:
    PipeName:
      -'\46a676ab7f179e511e30dd2dc41bd388'
      -'\583da945-62af-10e8-4902-a8f205c72b2e'
      -'\6e7645c4-32c5-4fe3-aabf-e94c2f4370e7'
      -'\9f81f59bc58452127884ce513865ed20'
      -'\adschemerpc'
      -'\ahexec'
      -'\AnonymousPipe'
      -'\bc31a7'
      -'\bc367'
      -'\bizkaz'
      -'\csexecsvc'
      -'\dce_3d'
      -'\e710f28d59aa529d6792ca6ff0ca1b34'
      -'\gruntsvc'
      -'\isapi_dg'
      -'\isapi_dg2'
      -'\isapi_http'
      -'\jaccdpqnvbrrxlaf'
      -'\lsassw'
      -'\NamePipe_MoreWindows'
      -'\pcheap_reuse'
      -'\Posh*'
      -'\rpchlp_3'
      -'\sdlrpc'
      -'\svcctl'
      -'\testPipe'
      -'\winsession'

  condition:selection
Falsepositives:
  -Unknown
Level: critical