Turla Group Named Pipe Creation

SigmaHQ Detections@sigmaHQ

•updated Jun 4, 2025•0•23

Detects the creation of named pipes with specific names known to be used by the Turla APT group. These named pipes include '\atctl', '\comnap', '\iehelper', '\sdlrpc', and '\userpipe'. The rule relies on Sysmon Event ID 17 or 18 for named pipe creation events.