Event ID 17 — PipeEvent (Pipe Created)

Provider: Microsoft-Windows-Sysmon
Channel: Operational
Level: Informational
Collection Priority: Recommended (Palantir, others)
Task: Pipe Created (rule: PipeEvent)
Opcode: Info

Description

This event generates when a named pipe is created.

Message #

Pipe Created:
RuleName: %1
EventType: %2
UtcTime: %3
ProcessGuid: %4
ProcessId: %5
PipeName: %6
Image: %7
User: %8

Fields #

Name	Description
`RuleName` UnicodeString → string	Custom tag mapped to event, i.e. ATT&CK technique ID
`EventType` UnicodeString → string	The type of pipe event (CreatePipe)
`UtcTime` UnicodeString → string	Time in UTC when event was created
`ProcessGuid` GUID → GUID	Process GUID of the process that created the pipe
`ProcessId` UInt32 → PID	Process ID used by the OS to identify the process that created the pipe
`PipeName` UnicodeString → string	Name of the pipe created
`Image` UnicodeString → string	File path of the process that created the pipe
`User` UnicodeString → string	The name of the account that created the named pipe.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Sysmon",
    "guid": "5770385F-C22A-43E0-BF4C-06F5698FFBD9",
    "event_source_name": "",
    "event_id": 17,
    "version": 1,
    "level": 4,
    "task": 17,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2023-11-06T02:02:24.642500+00:00",
    "event_record_id": 1433023,
    "correlation": {},
    "execution": {
      "process_id": 7064,
      "thread_id": 9788
    },
    "channel": "Microsoft-Windows-Sysmon/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "RuleName": "-",
    "EventType": "CreatePipe",
    "UtcTime": "2023-11-06 02:02:24.630",
    "ProcessGuid": "E56ADA26-1A27-6548-3001-000000000D00",
    "ProcessId": 876,
    "PipeName": "\\LOCAL\\mojo.876.3204.14485637353733294330",
    "Image": "C:\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\119.0.2151.44\\msedgewebview2.exe",
    "User": "WINDEV2310EVAL\\User"
  },
  "message": ""
}

Detection Patterns #

Named Pipe

Sysmon Event ID 17: PipeEventOREvent ID 18: PipeEvent

23 rules

Sigma

WMI Event Consumer Created Named Pipe (source)

Florian Roth (Nextron Systems)

Alternate PowerShell Hosts Pipe (source)

Roberto Rodriguez @Cyb3rWard0g, Tim Shelton

New PowerShell Instance Created (source)

Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)

Show 13 more (16 total)

PUA - CSExec Default Named Pipe (source)

Nikita Nazarov, oscd.community, Nasreddine Bencherchali (Nextron Systems)

PUA - PAExec Default Named Pipe (source)

Nasreddine Bencherchali (Nextron Systems)

PUA - RemCom Default Named Pipe (source)

Nikita Nazarov, oscd.community, Nasreddine Bencherchali (Nextron Systems)

PsExec Tool Execution From Suspicious Locations - PipeName (source)

Nasreddine Bencherchali (Nextron Systems)

CobaltStrike Named Pipe (source)

Florian Roth (Nextron Systems), Wojciech Lesicki

CobaltStrike Named Pipe Pattern Regex (source)

Florian Roth (Nextron Systems)

CobaltStrike Named Pipe Patterns (source)

Florian Roth (Nextron Systems), Christian Burkard (Nextron Systems)

HackTool - CoercedPotato Named Pipe Creation (source)

Florian Roth (Nextron Systems)

HackTool - EfsPotato Named Pipe Creation (source)

Florian Roth (Nextron Systems)

Malicious Named Pipe Created (source)

Florian Roth (Nextron Systems), blueteam0ps, elhoim

HackTool - Koh Default Named Pipe (source)

Nasreddine Bencherchali (Nextron Systems)

HackTool - Credential Dumping Tools Named Pipe Created (source)

Teymur Kheirkhabarov, oscd.community

ADFS Database Named Pipe Connection By Uncommon Tool (source)

Roberto Rodriguez @Cyb3rWard0g

Splunk

Trickbot Named Pipe (source)

Teoderick Contreras, Splunk

Windows PUA Named Pipe (source)

Raven Tait, Splunk

Windows RMM Named Pipe (source)

Raven Tait, Splunk

Show 2 more (5 total)

Windows Suspicious C2 Named Pipe (source)

Raven Tait, Splunk

Windows Suspicious Named Pipe (source)

Raven Tait, Splunk

Kusto Query Language

Solorigate Named Pipe (source)

Microsoft Security Research

Suspicious named pipes (source)

Named Pipe

Sysmon Event ID 17: PipeEventANDEvent ID 18: PipeEvent

19 rules

Sigma

CobaltStrike Named Pipe (source)

Florian Roth (Nextron Systems), Wojciech Lesicki

CobaltStrike Named Pipe Pattern Regex (source)

Florian Roth (Nextron Systems)

CobaltStrike Named Pipe Patterns (source)

Florian Roth (Nextron Systems), Christian Burkard (Nextron Systems)

Show 5 more (8 total)

HackTool - CoercedPotato Named Pipe Creation (source)

Florian Roth (Nextron Systems)

HackTool - EfsPotato Named Pipe Creation (source)

Florian Roth (Nextron Systems)

Malicious Named Pipe Created (source)

Florian Roth (Nextron Systems), blueteam0ps, elhoim

PUA - CSExec Default Named Pipe (source)

Nikita Nazarov, oscd.community, Nasreddine Bencherchali (Nextron Systems)

PUA - RemCom Default Named Pipe (source)

Nikita Nazarov, oscd.community, Nasreddine Bencherchali (Nextron Systems)

Splunk

Windows Anonymous Pipe Activity (source)

Teoderick Contreras, Splunk

Windows PUA Named Pipe (source)

Raven Tait, Splunk

Windows RMM Named Pipe (source)

Raven Tait, Splunk

Show 6 more (9 total)

Windows Suspicious C2 Named Pipe (source)

Raven Tait, Splunk

Windows Suspicious Named Pipe (source)

Raven Tait, Splunk

Trickbot Named Pipe (source)

Teoderick Contreras, Splunk

Windows App Layer Protocol Qakbot NamedPipe (source)

Teoderick Contreras, Splunk

Windows App Layer Protocol Wermgr Connect To NamedPipe (source)

Teoderick Contreras, Splunk

Windows Application Layer Protocol RMS Radmin Tool Namedpipe (source)

Teoderick Contreras, Splunk

Kusto Query Language

Suspicious named pipes (source)

Solorigate Named Pipe (source)

Microsoft Security Research

Named Pipe

Defender-DeviceEvents Event ID 9007006: Named pipe eventORSysmon Event ID 17: PipeEventOREvent ID 18: PipeEvent

15 rules

Sigma

CobaltStrike Named Pipe (source)

Florian Roth (Nextron Systems), Wojciech Lesicki

CobaltStrike Named Pipe Pattern Regex (source)

Florian Roth (Nextron Systems)

CobaltStrike Named Pipe Patterns (source)

Florian Roth (Nextron Systems), Christian Burkard (Nextron Systems)

Show 3 more (6 total)

HackTool - CoercedPotato Named Pipe Creation (source)

Florian Roth (Nextron Systems)

HackTool - EfsPotato Named Pipe Creation (source)

Florian Roth (Nextron Systems)

Malicious Named Pipe Created (source)

Florian Roth (Nextron Systems), blueteam0ps, elhoim

Splunk

Windows Anonymous Pipe Activity (source)

Teoderick Contreras, Splunk

Windows PUA Named Pipe (source)

Raven Tait, Splunk

Windows RMM Named Pipe (source)

Raven Tait, Splunk

Show 3 more (6 total)

Windows Suspicious C2 Named Pipe (source)

Raven Tait, Splunk

Windows Suspicious Named Pipe (source)

Raven Tait, Splunk

Trickbot Named Pipe (source)

Teoderick Contreras, Splunk

Kusto Query Language

Suspicious named pipes (source)

Solorigate Named Pipe (source)

Microsoft Security Research

C2-NamedPipe (source)

Named Pipe

Security-Auditing Event ID 5145: A network share object was checked to see whether client can be granted desired access.ORSysmon Event ID 17: PipeEventOREvent ID 18: PipeEvent

13 rules

Sigma

CobaltStrike Named Pipe (source)

Florian Roth (Nextron Systems), Wojciech Lesicki

CobaltStrike Named Pipe Pattern Regex (source)

Florian Roth (Nextron Systems)

CobaltStrike Named Pipe Patterns (source)

Florian Roth (Nextron Systems), Christian Burkard (Nextron Systems)

Show 3 more (6 total)

HackTool - CoercedPotato Named Pipe Creation (source)

Florian Roth (Nextron Systems)

HackTool - EfsPotato Named Pipe Creation (source)

Florian Roth (Nextron Systems)

Malicious Named Pipe Created (source)

Florian Roth (Nextron Systems), blueteam0ps, elhoim

Splunk

Trickbot Named Pipe (source)

Teoderick Contreras, Splunk

Windows PUA Named Pipe (source)

Raven Tait, Splunk

Windows RMM Named Pipe (source)

Raven Tait, Splunk

Show 2 more (5 total)

Windows Suspicious C2 Named Pipe (source)

Raven Tait, Splunk

Windows Suspicious Named Pipe (source)

Raven Tait, Splunk

Kusto Query Language

Solorigate Named Pipe (source)

Microsoft Security Research

Suspicious named pipes (source)

Detection Rules #

View all rules referencing this event →

Sigma # view in reference

HackTool - DiagTrackEoP Default Named Pipe source critical: Detects creation of default named pipe used by the DiagTrackEoP POC, a tool that abuses "SeImpersonate" privilege.↳ also matches:Event ID 18: PipeEvent (Pipe Connected)

Elastic # view in reference

Privilege Escalation via Rogue Named Pipe Impersonation source high: Identifies a privilege escalation attempt via rogue named pipe impersonation. An adversary may abuse this technique by masquerading as a known named pipe and manipulating a privileged process to connect to it.

References #

Microsoft Learn https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-17-pipeevent-pipe-created
Example event sourced from https://github.com/NextronSystems/evtx-baseline
OSSEM-DD https://github.com/OTRF/OSSEM-DD/blob/main/windows/sysmon/events/event-17.yml