Detection rules › By event

Microsoft-Windows-Sysmon event 17

27 detection rules reference this event. View event page.

Sigma (17)

ADFS Database Named Pipe Connection By Uncommon Tool severity medium T1005
Alternate PowerShell Hosts Pipe severity medium T1059.001
CobaltStrike Named Pipe severity critical T1055
CobaltStrike Named Pipe Pattern Regex severity critical T1055
CobaltStrike Named Pipe Patterns severity high T1055
HackTool - CoercedPotato Named Pipe Creation severity high T1055
HackTool - Credential Dumping Tools Named Pipe Created severity critical T1003.001, T1003.002, T1003.004, T1003.005
HackTool - DiagTrackEoP Default Named Pipe severity critical
HackTool - EfsPotato Named Pipe Creation severity high T1055
HackTool - Koh Default Named Pipe severity critical T1134.001, T1528
Malicious Named Pipe Created severity critical T1055
New PowerShell Instance Created severity informational T1059.001
PsExec Tool Execution From Suspicious Locations - PipeName severity medium T1569.002
PUA - CSExec Default Named Pipe severity medium T1021.002, T1569.002
PUA - PAExec Default Named Pipe severity medium T1569.002
PUA - RemCom Default Named Pipe severity medium T1021.002, T1569.002
WMI Event Consumer Created Named Pipe severity medium T1047

Elastic (1)

Privilege Escalation via Rogue Named Pipe Impersonation T1134, T1134.001