Elastic high stable eql

Privilege Escalation via Rogue Named Pipe Impersonation

Identifies a privilege escalation attempt via rogue named pipe impersonation. An adversary may abuse this technique by masquerading as a known named pipe and manipulating a privileged process to connect to it.

View Source

Detection Logic

file where host.os.type == "windows" and
  event.provider == "Microsoft-Windows-Sysmon" and
  
  /* Named Pipe Creation */
  event.code == "17" and
  
  /* Sysmon truncates the "Pipe" keyword in normal named pipe creation events */
  file.name : "\\*\\Pipe\\*"

Field Validations

Loading…

Comments (0)

Loading comments...