NtdllPipe-like Activity for AV/EDR Evasion
This rule detects attempts to evade antivirus/EDR detection by piping the content of ntdll.dll to another file or a named pipe. This technique, as demonstrated in the 'NtdllPipe' proof-of-concept, involves using the 'type' command to read the contents of 'ntdll.dll' and redirecting its output, often to a named pipe, to bypass security controls that might monitor direct file access or execution of ntdll.dll.
Sigma
