Cobalt Strike Named Pipe Creation
This rule detects the creation of named pipes with specific naming conventions commonly used by Cobalt Strike. Cobalt Strike is a legitimate penetration testing tool that is frequently misused by threat actors for post-exploitation activities. The rule looks for pipe names containing "\MSSE-" and "-server", or starting with "\postex_", "\status_", "\msagent_", "\mojo_", "\interprocess_", "\samr_", "\netlogon_", "\srvsvc_", "\lsarpc_", or "\wkssvc_". These patterns are indicative of Cobalt Strike's beacon communication or other internal operations.
Sigma
