HackTool - DiagTrackEoP Default Named Pipe

 1title: HackTool - DiagTrackEoP Default Named Pipe
 2id: 1f7025a6-e747-4130-aac4-961eb47015f1
 3status: experimental
 4description: Detects creation of default named pipe used by the DiagTrackEoP POC, a tool that abuses "SeImpersonate" privilege.
 5references:
 6    - https://github.com/Wh04m1001/DiagTrackEoP/blob/3a2fc99c9700623eb7dc7d4b5f314fd9ce5ef51f/main.cpp#L22
 7author: Nasreddine Bencherchali (Nextron Systems)
 8date: 2022/08/03
 9modified: 2023/08/07
10tags:
11    - attack.privilege_escalation
12logsource:
13    product: windows
14    category: pipe_created
15    definition: 'Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575'
16detection:
17    selection:
18        PipeName|contains: 'thisispipe' # Based on source code
19    condition: selection
20falsepositives:
21    - Unlikely
22level: critical