First Time Seen Remote Named Pipe - Zeek
This rule detects the first-time observation of remote named pipe connections, excluding a predefined list of common and legitimate named pipes. This behavior is often indicative of lateral movement or remote execution using named pipes, which attackers commonly leverage to move within a network or execute code on remote systems. The rule specifically looks for connections to '\\*\IPC$', a common administrative share used for interprocess communication over a network. By filtering out known legitimate named pipes, the rule aims to reduce false positives and highlight potentially malicious activity.
Sigma
