Event ID 18 — PipeEvent (Pipe Connected)

Provider: Microsoft-Windows-Sysmon
Channel: Operational
Level: Informational
Collection Priority: Recommended (Palantir, others)
Task: Pipe Connected (rule: PipeEvent)
Opcode: Info

Description

This event logs when a named pipe connection is made between a client and a server.

Message #

Pipe Connected:
RuleName: %1
EventType: %2
UtcTime: %3
ProcessGuid: %4
ProcessId: %5
PipeName: %6
Image: %7
User: %8

Fields #

Name	Description
`RuleName` UnicodeString → string	Custom tag mapped to event, i.e. ATT&CK technique ID
`EventType` UnicodeString → string	The type of pipe event (ConnectPipe)
`UtcTime` UnicodeString → string	Time in UTC when event was created
`ProcessGuid` GUID → GUID	Process GUID of the process that connected the pipe
`ProcessId` UInt32 → PID	Process ID used by the OS to identify the process that connected the pipe
`PipeName` UnicodeString → string	Name of the pipe connected
`Image` UnicodeString → string	File path of the process that connected the pipe
`User` UnicodeString → string	The name of the account that made a named pipe connection.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Sysmon",
    "guid": "5770385F-C22A-43E0-BF4C-06F5698FFBD9",
    "event_source_name": "",
    "event_id": 18,
    "version": 1,
    "level": 4,
    "task": 18,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2023-11-06T02:04:25.137463+00:00",
    "event_record_id": 1441110,
    "correlation": {},
    "execution": {
      "process_id": 7064,
      "thread_id": 9788
    },
    "channel": "Microsoft-Windows-Sysmon/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "RuleName": "-",
    "EventType": "ConnectPipe",
    "UtcTime": "2023-11-06 02:04:25.084",
    "ProcessGuid": "E56ADA26-17F7-6548-5800-000000000D00",
    "ProcessId": 4404,
    "PipeName": "\\wkssvc",
    "Image": "C:\\Windows\\system32\\wbem\\wmiprvse.exe",
    "User": "NT AUTHORITY\\NETWORK SERVICE"
  },
  "message": ""
}

Detection Patterns #

Named Pipe

Sysmon Event ID 17: PipeEventOREvent ID 18: PipeEvent

23 rules

Sigma

WMI Event Consumer Created Named Pipe (source)

Florian Roth (Nextron Systems)

Alternate PowerShell Hosts Pipe (source)

Roberto Rodriguez @Cyb3rWard0g, Tim Shelton

New PowerShell Instance Created (source)

Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)

Show 13 more (16 total)

PUA - CSExec Default Named Pipe (source)

Nikita Nazarov, oscd.community, Nasreddine Bencherchali (Nextron Systems)

PUA - PAExec Default Named Pipe (source)

Nasreddine Bencherchali (Nextron Systems)

PUA - RemCom Default Named Pipe (source)

Nikita Nazarov, oscd.community, Nasreddine Bencherchali (Nextron Systems)

PsExec Tool Execution From Suspicious Locations - PipeName (source)

Nasreddine Bencherchali (Nextron Systems)

CobaltStrike Named Pipe (source)

Florian Roth (Nextron Systems), Wojciech Lesicki

CobaltStrike Named Pipe Pattern Regex (source)

Florian Roth (Nextron Systems)

CobaltStrike Named Pipe Patterns (source)

Florian Roth (Nextron Systems), Christian Burkard (Nextron Systems)

HackTool - CoercedPotato Named Pipe Creation (source)

Florian Roth (Nextron Systems)

HackTool - EfsPotato Named Pipe Creation (source)

Florian Roth (Nextron Systems)

Malicious Named Pipe Created (source)

Florian Roth (Nextron Systems), blueteam0ps, elhoim

HackTool - Koh Default Named Pipe (source)

Nasreddine Bencherchali (Nextron Systems)

HackTool - Credential Dumping Tools Named Pipe Created (source)

Teymur Kheirkhabarov, oscd.community

ADFS Database Named Pipe Connection By Uncommon Tool (source)

Roberto Rodriguez @Cyb3rWard0g

Splunk

Trickbot Named Pipe (source)

Teoderick Contreras, Splunk

Windows PUA Named Pipe (source)

Raven Tait, Splunk

Windows RMM Named Pipe (source)

Raven Tait, Splunk

Show 2 more (5 total)

Windows Suspicious C2 Named Pipe (source)

Raven Tait, Splunk

Windows Suspicious Named Pipe (source)

Raven Tait, Splunk

Kusto Query Language

Solorigate Named Pipe (source)

Microsoft Security Research

Suspicious named pipes (source)

Named Pipe

Sysmon Event ID 17: PipeEventANDEvent ID 18: PipeEvent

19 rules

Sigma

CobaltStrike Named Pipe (source)

Florian Roth (Nextron Systems), Wojciech Lesicki

CobaltStrike Named Pipe Pattern Regex (source)

Florian Roth (Nextron Systems)

CobaltStrike Named Pipe Patterns (source)

Florian Roth (Nextron Systems), Christian Burkard (Nextron Systems)

Show 5 more (8 total)

HackTool - CoercedPotato Named Pipe Creation (source)

Florian Roth (Nextron Systems)

HackTool - EfsPotato Named Pipe Creation (source)

Florian Roth (Nextron Systems)

Malicious Named Pipe Created (source)

Florian Roth (Nextron Systems), blueteam0ps, elhoim

PUA - CSExec Default Named Pipe (source)

Nikita Nazarov, oscd.community, Nasreddine Bencherchali (Nextron Systems)

PUA - RemCom Default Named Pipe (source)

Nikita Nazarov, oscd.community, Nasreddine Bencherchali (Nextron Systems)

Splunk

Windows Anonymous Pipe Activity (source)

Teoderick Contreras, Splunk

Windows PUA Named Pipe (source)

Raven Tait, Splunk

Windows RMM Named Pipe (source)

Raven Tait, Splunk

Show 6 more (9 total)

Windows Suspicious C2 Named Pipe (source)

Raven Tait, Splunk

Windows Suspicious Named Pipe (source)

Raven Tait, Splunk

Trickbot Named Pipe (source)

Teoderick Contreras, Splunk

Windows App Layer Protocol Qakbot NamedPipe (source)

Teoderick Contreras, Splunk

Windows App Layer Protocol Wermgr Connect To NamedPipe (source)

Teoderick Contreras, Splunk

Windows Application Layer Protocol RMS Radmin Tool Namedpipe (source)

Teoderick Contreras, Splunk

Kusto Query Language

Suspicious named pipes (source)

Solorigate Named Pipe (source)

Microsoft Security Research

Named Pipe

Defender-DeviceEvents Event ID 9007006: Named pipe eventORSysmon Event ID 17: PipeEventOREvent ID 18: PipeEvent

15 rules

Sigma

CobaltStrike Named Pipe (source)

Florian Roth (Nextron Systems), Wojciech Lesicki

CobaltStrike Named Pipe Pattern Regex (source)

Florian Roth (Nextron Systems)

CobaltStrike Named Pipe Patterns (source)

Florian Roth (Nextron Systems), Christian Burkard (Nextron Systems)

Show 3 more (6 total)

HackTool - CoercedPotato Named Pipe Creation (source)

Florian Roth (Nextron Systems)

HackTool - EfsPotato Named Pipe Creation (source)

Florian Roth (Nextron Systems)

Malicious Named Pipe Created (source)

Florian Roth (Nextron Systems), blueteam0ps, elhoim

Splunk

Windows Anonymous Pipe Activity (source)

Teoderick Contreras, Splunk

Windows PUA Named Pipe (source)

Raven Tait, Splunk

Windows RMM Named Pipe (source)

Raven Tait, Splunk

Show 3 more (6 total)

Windows Suspicious C2 Named Pipe (source)

Raven Tait, Splunk

Windows Suspicious Named Pipe (source)

Raven Tait, Splunk

Trickbot Named Pipe (source)

Teoderick Contreras, Splunk

Kusto Query Language

Suspicious named pipes (source)

Solorigate Named Pipe (source)

Microsoft Security Research

C2-NamedPipe (source)

Named Pipe

Security-Auditing Event ID 5145: A network share object was checked to see whether client can be granted desired access.ORSysmon Event ID 17: PipeEventOREvent ID 18: PipeEvent

13 rules

Sigma

CobaltStrike Named Pipe (source)

Florian Roth (Nextron Systems), Wojciech Lesicki

CobaltStrike Named Pipe Pattern Regex (source)

Florian Roth (Nextron Systems)

CobaltStrike Named Pipe Patterns (source)

Florian Roth (Nextron Systems), Christian Burkard (Nextron Systems)

Show 3 more (6 total)

HackTool - CoercedPotato Named Pipe Creation (source)

Florian Roth (Nextron Systems)

HackTool - EfsPotato Named Pipe Creation (source)

Florian Roth (Nextron Systems)

Malicious Named Pipe Created (source)

Florian Roth (Nextron Systems), blueteam0ps, elhoim

Splunk

Trickbot Named Pipe (source)

Teoderick Contreras, Splunk

Windows PUA Named Pipe (source)

Raven Tait, Splunk

Windows RMM Named Pipe (source)

Raven Tait, Splunk

Show 2 more (5 total)

Windows Suspicious C2 Named Pipe (source)

Raven Tait, Splunk

Windows Suspicious Named Pipe (source)

Raven Tait, Splunk

Kusto Query Language

Solorigate Named Pipe (source)

Microsoft Security Research

Suspicious named pipes (source)

Collection: Data from Local System

Sysmon Event ID 3: Network connectionOREvent ID 18: PipeEvent

1 rule

Kusto Query Language

AD FS Remote HTTP Network Connection (source)

Detection Rules #

View all rules referencing this event →

Sigma # view in reference

HackTool - DiagTrackEoP Default Named Pipe source critical: Detects creation of default named pipe used by the DiagTrackEoP POC, a tool that abuses "SeImpersonate" privilege.↳ also matches:Event ID 17: PipeEvent (Pipe Created)

Kusto Query Language # view in reference

ADFS Database Named Pipe Connection source medium: 'This detection uses Sysmon telemetry to detect suspicious local connections via a named pipe to the AD FS configuration database (Windows Internal Database). In order to use this query you need to be collecting Sysmon EventIdD 18 (Pipe Connected). If you do not have Sysmon data in your workspace this query will raise an error stating: Failed to resolve scalar expression named "[@Name]"'

References #

Microsoft Learn https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-18-pipeevent-pipe-connected
Example event sourced from https://github.com/NextronSystems/evtx-baseline
OSSEM-DD https://github.com/OTRF/OSSEM-DD/blob/main/windows/sysmon/events/event-18.yml