Log source category
pipe_created log source Sigma rules
20 Sigma detection rules in the library use the pipe_created log source, mostly on windows. The pipe_created category groups related telemetry so you can find detections that consume the same events. Open a rule to read its detection logic, MITRE ATT&CK mapping and original YAML.
CobaltStrike Named Pipe
criticalDetects the creation of a named pipe as used by CobaltStrike
windows
CobaltStrike Named Pipe Pattern Regex
criticalDetects the creation of a named pipe matching a pattern used by CobaltStrike Malleable C2 profiles
windows
HackTool - Credential Dumping Tools Named Pipe Created
criticalDetects well-known credential dumping tools execution via specific named pipe creation
windows
HackTool - DiagTrackEoP Default Named Pipe
criticalDetects creation of default named pipe used by the DiagTrackEoP POC, a tool that abuses "SeImpersonate" privilege.
windows
HackTool - Koh Default Named Pipe
criticalDetects creation of default named pipes used by the Koh tool
windows
Malicious Named Pipe Created
criticalDetects the creation of a named pipe seen used by known APTs or malware.
windows
RedSun - Named Pipe Created
criticalDetects the creation of a named pipe with the hardcoded name "REDSUN". The RedSun exploit tool uses a pipe with this name for synchronisation and command communication between its components during the Cloud Files API + oplock-based AV bypass and privilege escalation chain. RedSun creates the pipe as \\??\pipe\REDSUN. The pipe server listens for the token-duplicated elevated process to connect and respond, completing the privilege escalation from user to SYSTEM. Presence of this pipe name indicates active or recent RedSun execution.
windows
Turla Group Named Pipes
criticalDetects a named pipe used by Turla group samples
windows
CobaltStrike Named Pipe Patterns
highDetects the creation of a named pipe with a pattern found in CobaltStrike malleable C2 profiles
windows
HackTool - CoercedPotato Named Pipe Creation
highDetects the pattern of a pipe name as used by the hack tool CoercedPotato
windows
HackTool - EfsPotato Named Pipe Creation
highDetects the pattern of a pipe name as used by the hack tool EfsPotato
windows
ADFS Database Named Pipe Connection By Uncommon Tool
mediumDetects suspicious local connections via a named pipe to the AD FS configuration database (Windows Internal Database). Used to access information such as the AD FS configuration settings which contains sensitive information used to sign SAML tokens.
windows
Alternate PowerShell Hosts Pipe
mediumDetects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe
windows
PsExec Tool Execution From Suspicious Locations - PipeName
mediumDetects PsExec default pipe creation where the image executed is located in a suspicious location. Which could indicate that the tool is being used in an attack
windows
PUA - CSExec Default Named Pipe
mediumDetects default CSExec pipe creation
windows
PUA - PAExec Default Named Pipe
mediumDetects PAExec default named pipe
windows
PUA - RemCom Default Named Pipe
mediumDetects default RemCom pipe creation
windows
WMI Event Consumer Created Named Pipe
mediumDetects the WMI Event Consumer service scrcons.exe creating a named pipe
windows
PsExec Default Named Pipe
lowDetects PsExec service default pipe creation
windows
New PowerShell Instance Created
informationalDetects the execution of PowerShell via the creation of a named pipe starting with PSHost
windows