CobaltStrike Named Pipe Patterns
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects the creation of a named pipe with a pattern found in CobaltStrike malleable C2 profiles
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "sa_pipe_created" AND ((OBJECTNAME startswith "\DserNamePipe,\f4c3,\f53f,\fullduplex_,\mojo.5688.8052.183894939787088877,\mojo.5688.8052.35780273329370473,\MsFteWds,\msrpc_,\mypipe-f,\mypipe-h,\ntsvcs,\PGMessagePipe,\rpc_,\scerpc,\SearchTextHarvester,\spoolss,\win_svc,\win\msrpc_,\windows.update.manager,\wkssvc" OR OBJECTNAME = "\demoagent_11,\demoagent_22") OR (OBJECTNAME startswith "\Winsock2\CatalogChangeListener-" AND OBJECTNAME endswith "-0,")) AND OBJECTNAME != "\wkssvc,\spoolss,\scerpc,\ntsvcs,\SearchTextHarvester,\PGMessagePipe,\MsFteWds" AND (PROCESSNAME notcontains ":\Program Files\Websense\,:\Program Files (x86)\Websense" OR OBJECTNAME notstartswith "\DserNamePipeR,\DserNamePipeW") select Action1.HOSTNAME,Action1.MESSAGE,Action1.PROCESSNAME,Action1.OBJECTNAME,Action1.ACCESSES
Detection
Execution Mode
realtime
Log Sources
Windows
Author
Florian Roth (Nextron Systems), Christian Burkard (Nextron Systems)
