CobaltStrike Named Pipe Pattern Regex

{
  "pipe_created": {
    "EventID": [
      17,
      18
    ],
    "Channel": "Microsoft-Windows-Sysmon/Operational"
  },
  "selection": [
    {
      "PipeName
| re": "\\\\mojo\\.5688\\.8052\\.(?:183894939787088877
| 35780273329370473)[0-9a-f]{2}"
    },
    {
      "PipeName
| re": "\\\\wkssvc_?[0-9a-f]{2}"
    },
    {
      "PipeName
| re": "\\\\ntsvcs[0-9a-f]{2}"
    },
    {
      "PipeName
| re": "\\\\DserNamePipe[0-9a-f]{2}"
    },
    {
      "PipeName
| re": "\\\\SearchTextHarvester[0-9a-f]{2}"
    },
    {
      "PipeName
| re": "\\\\mypipe-(?:f
| h)[0-9a-f]{2}"
    },
    {
      "PipeName
| re": "\\\\windows\\.update\\.manager[0-9a-f]{2,3}"
    },
    {
      "PipeName
| re": "\\\\ntsvcs_[0-9a-f]{2}"
    },
    {
      "PipeName
| re": "\\\\scerpc_?[0-9a-f]{2}"
    },
    {
      "PipeName
| re": "\\\\PGMessagePipe[0-9a-f]{2}"
    },
    {
      "PipeName
| re": "\\\\MsFteWds[0-9a-f]{2}"
    },
    {
      "PipeName
| re": "\\\\f4c3[0-9a-f]{2}"
    },
    {
      "PipeName
| re": "\\\\fullduplex_[0-9a-f]{2}"
    },
    {
      "PipeName
| re": "\\\\msrpc_[0-9a-f]{4}"
    },
    {
      "PipeName
| re": "\\\\win\\\\msrpc_[0-9a-f]{2}"
    },
    {
      "PipeName
| re": "\\\\f53f[0-9a-f]{2}$"
    },
    {
      "PipeName
| re": "\\\\rpc_[0-9a-f]{2}"
    },
    {
      "PipeName
| re": "\\\\spoolss_[0-9a-f]{2}"
    },
    {
      "PipeName
| re": "\\\\Winsock2\\\\CatalogChangeListener-[0-9a-f]{3}-0,"
    }
  ],
  "condition": "pipe_created and selection"
}

False Positives

• ⚠ Unknown