CobaltStrike Named Pipe Pattern Regex

Severity: critical
Author: Florian Roth (Nextron Systems)
Source: upstream

Detects the creation of a named pipe matching a pattern used by CobaltStrike Malleable C2 profiles

MITRE ATT&CK coverage

Tactic	Techniques
Privilege Escalation	`T1055` Process Injection
Defense Evasion	`T1055` Process Injection

Event coverage

Provider	Event ID	Title
Sysmon	17	PipeEvent (Pipe Created)
Sysmon	18	PipeEvent (Pipe Connected)

Stages and Predicates

Stage 1: `selection`

or:
PipeName|re: '\\DserNamePipe[0-9a-f]{2}'
PipeName|re: '\\MsFteWds[0-9a-f]{2}'
PipeName|re: '\\PGMessagePipe[0-9a-f]{2}'
PipeName|re: '\\SearchTextHarvester[0-9a-f]{2}'
PipeName|re: '\\Winsock2\\CatalogChangeListener-[0-9a-f]{3}-0,'
PipeName|re: '\\f4c3[0-9a-f]{2}'
PipeName|re: '\\f53f[0-9a-f]{2}'
PipeName|re: '\\fullduplex_[0-9a-f]{2}'
PipeName|re: '\\mojo\.5688\.8052\.(?:183894939787088877|35780273329370473)[0-9a-f]{2}'
PipeName|re: '\\msrpc_[0-9a-f]{4}'
PipeName|re: '\\mypipe-(?:f|h)[0-9a-f]{2}'
PipeName|re: '\\ntsvcs[0-9a-f]{2}'
PipeName|re: '\\ntsvcs_[0-9a-f]{2}'
PipeName|re: '\\rpc_[0-9a-f]{2}'
PipeName|re: '\\scerpc_?[0-9a-f]{2}'
PipeName|re: '\\spoolss_[0-9a-f]{2}'
PipeName|re: '\\win\\msrpc_[0-9a-f]{2}'
PipeName|re: '\\windows\.update\.manager[0-9a-f]{2,3}'
PipeName|re: '\\wkssvc_?[0-9a-f]{2}'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.