pipe_created

HackTool - EfsPotato Named Pipe Creation

Nov 1, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 ·

Share on:

Detects the pattern of a pipe name as used by the hack tool EfsPotato

Alternate PowerShell Hosts Pipe

Oct 8, 2024 · attack.execution attack.t1059.001 ·

Share on:

Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe

HackTool - CoercedPotato Named Pipe Creation

Sep 2, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 ·

Share on:

Detects the pattern of a pipe name as used by the hack tool CoercedPotato

ADFS Database Named Pipe Connection By Uncommon Tool

Aug 12, 2024 · attack.collection attack.t1005 ·

Share on:

Detects suspicious local connections via a named pipe to the AD FS configuration database (Windows Internal Database). Used to access information such as the AD FS configuration settings which contains sensitive information used to sign SAML tokens.

CobaltStrike Named Pipe

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 ·

Share on:

Detects the creation of a named pipe as used by CobaltStrike

CobaltStrike Named Pipe Pattern Regex

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 ·

Share on:

Detects the creation of a named pipe matching a pattern used by CobaltStrike Malleable C2 profiles

CobaltStrike Named Pipe Patterns

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 stp.1k ·

Share on:

Detects the creation of a named pipe with a pattern found in CobaltStrike malleable C2 profiles

HackTool - Credential Dumping Tools Named Pipe Created

Aug 12, 2024 · attack.credential-access attack.t1003.001 attack.t1003.002 attack.t1003.004 attack.t1003.005 ·

Share on:

Detects well-known credential dumping tools execution via specific named pipe creation

HackTool - DiagTrackEoP Default Named Pipe

Aug 12, 2024 · attack.privilege-escalation ·

Share on:

Detects creation of default named pipe used by the DiagTrackEoP POC, a tool that abuses "SeImpersonate" privilege.

HackTool - Koh Default Named Pipe

Aug 12, 2024 · attack.privilege-escalation attack.credential-access attack.t1528 attack.t1134.001 ·

Share on:

Detects creation of default named pipes used by the Koh tool

Malicious Named Pipe Created

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1055 ·

Share on:

Detects the creation of a named pipe seen used by known APTs or malware.

New PowerShell Instance Created

Aug 12, 2024 · attack.execution attack.t1059.001 ·

Share on:

Detects the execution of PowerShell via the creation of a named pipe starting with PSHost

PsExec Tool Execution From Suspicious Locations - PipeName

Aug 12, 2024 · attack.execution attack.t1569.002 attack.s0029 ·

Share on:

Detects PsExec default pipe creation where the image executed is located in a suspicious location. Which could indicate that the tool is being used in an attack

PUA - CSExec Default Named Pipe

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 attack.execution attack.t1569.002 ·

Share on:

Detects default CSExec pipe creation

PUA - PAExec Default Named Pipe

Aug 12, 2024 · attack.execution attack.t1569.002 ·

Share on:

Detects PAExec default named pipe

PUA - RemCom Default Named Pipe

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 attack.execution attack.t1569.002 ·