Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
255 detections
Filters
Last updated
All Time
Detection languages
84
82
27
24
11
Contributors
61
56
49
22
20
Categories
20,440
11,814
5,871
5,145
4,864
Platforms
247
9
5
3
2
Products / Services
122
67
19
10
7
MITRE Techniques
110
94
73
65
40
CVEs
3
2
2
1
1
IDS Classtypes
3
2
1
IDS Protocols
6
This rule detects the creation of a named pipe using `cmd.exe` or `powershell.exe` by looking for specific command-line arguments. The presence of `echo`, `>` and `\\.\pipe\` in the command line indicates an attempt to create or interact with a named pipe. This activity can be associated with privilege escalation techniques, where an attacker might use named pipes for inter-process communication to elevate privileges.
Detects the execution of PowerShell via the creation of a named pipe starting with 'PSHost'. This method can be used by adversaries to execute PowerShell commands or scripts, potentially bypassing traditional PowerShell logging mechanisms.
Detects the creation of the default named pipe for PsExec (PSEXESVC) when the PsExec executable is run from suspicious locations such as temporary directories, public user folders, or common download/desktop locations. This activity can indicate the use of PsExec by an attacker.
Detects the creation of named pipes with specific patterns known to be used by Cobalt Strike's malleable C2 profiles. This rule identifies common pipe names and patterns associated with Cobalt Strike's inter-process communication, including generic profiles and those related to catalog change listeners.
Detects the WMI Event Consumer service process (scrcons.exe) creating a named pipe. This activity can be indicative of WMI persistence mechanisms being used by adversaries, often in conjunction with named pipes for inter-process communication or command and control.
This rule detects the creation of named pipes with specific naming conventions commonly used by Cobalt Strike. Cobalt Strike is a legitimate penetration testing tool that is frequently misused by threat actors for post-exploitation activities. The rule looks for pipe names containing "\MSSE-" and "-server", or starting with "\postex_", "\status_", "\msagent_", "\mojo_", "\interprocess_", "\samr_", "\netlogon_", "\srvsvc_", "\lsarpc_", or "\wkssvc_". These patterns are indicative of Cobalt Strike's beacon communication or other internal operations.
Detects the creation of a named pipe with the default name used by RemCom, a legitimate remote administration tool that can be abused by attackers for lateral movement and execution.
Detects the creation of a named pipe with the default name '\csexecsvc', which is commonly used by CSExec for remote command execution. This activity is indicative of potential lateral movement or execution of unauthorized code.
Detects the creation of a named pipe with a name starting with '\PAExec', which is the default named pipe used by the PAExec utility. This can indicate remote execution activity using PAExec.
Detects the creation of a specific named pipe ('thisispipe') which is known to be used by the DiagTrackEoP Proof-of-Concept tool. This tool exploits the "SeImpersonate" privilege for privilege escalation on Windows systems.
Detects the use of the spoolss named pipe over SMB. This can be used to trigger the authentication via NTLM of any machine that has the spoolservice enabled.
Detects well-known credential dumping tools execution via specific named pipe creation
Detects the execution of PowerShell via the creation of a named pipe starting with PSHost
Detects PAExec default named pipe
Detects PsExec default pipe creation where the image executed is located in a suspicious location. Which could indicate that the tool is being used in an attack
This detection excludes known namped pipes accessible remotely and notify on newly observed ones, may help to detect lateral movement and remote exec using named pipes
Detects the use of the spoolss named pipe over SMB. This can be used to trigger the authentication via NTLM of any machine that has the spoolservice enabled.
This detection excludes known namped pipes accessible remotely and notify on newly observed ones, may help to detect lateral movement and remote exec using named pipes
Detects remote service activity via remote access to the svcctl named pipe
Detects suspicious local connections via a named pipe to the AD FS configuration database (Windows Internal Database).
Used to access information such as the AD FS configuration settings which contains sensitive information used to sign SAML tokens.
Used to access information such as the AD FS configuration settings which contains sensitive information used to sign SAML tokens.
Detects creation of default named pipe used by the DiagTrackEoP POC, a tool that abuses "SeImpersonate" privilege.
Page 12 of 13