Cobalt Strike Named Pipes

SPLUNK detection rule by Michael Haag, Splunk · Apache-2.0

The following analytic detects the use of default or publicly known named pipes associated with Cobalt Strike. It leverages Sysmon EventID 17 and 18 to identify specific named pipes commonly used by Cobalt Strike's Artifact Kit and Malleable C2 Profiles. This activity is significant because Cobalt Strike is a popular tool for adversaries to conduct post-exploitation tasks, and identifying its named pipes can reveal potential malicious activity. If confirmed malicious, this could indicate an active Cobalt Strike beacon, leading to unauthorized access, data exfiltration, or further lateral movement within the network.

name: Cobalt Strike Named Pipes
id: 5876d429-0240-4709-8b93-ea8330b411b5
version: 13
creation_date: '2021-02-22'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: removed
type: TTP
description: The following analytic detects the use of default or publicly known named pipes associated with Cobalt Strike. It leverages Sysmon EventID 17 and 18 to identify specific named pipes commonly used by Cobalt Strike's Artifact Kit and Malleable C2 Profiles. This activity is significant because Cobalt Strike is a popular tool for adversaries to conduct post-exploitation tasks, and identifying its named pipes can reveal potential malicious activity. If confirmed malicious, this could indicate an active Cobalt Strike beacon, leading to unauthorized access, data exfiltration, or further lateral movement within the network.
data_source:
    - Sysmon EventID 17
    - Sysmon EventID 18
search: |
    `sysmon` (EventID=17 OR EventID=18)
    PipeName IN (
      "\\DserNamePipe*",
      "\\interprocess_*",
      "\\lsarpc_*",
      "\\mojo_*",
      "\\msagent_*",
      "\\MSSE-*",
      "\\netlogon_*",
      "\\ntsvcs*",
      "\\postex_*",
      "\\samr_*",
      "\\spoolss_*",
      "\\srvsvc_*",
      "\\status_*",
      "\\UIA_PIPE*",
      "\\win_svc*",
      "\\winsock*",
      "\\wkssvc_*"
    )
    | stats count min(_time) as firstTime max(_time) as lastTime
    by dest dvc pipe_name process_exec process_guid process_id process_name process_path
    signature signature_id user_id vendor_product Image PipeName
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `cobalt_strike_named_pipes_filter`
how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
known_false_positives: The idea of using named pipes with Cobalt Strike is to blend in. Therefore, some of the named pipes identified and added may cause false positives. Filter by process name or pipe name to reduce false positives.
references:
    - https://attack.mitre.org/techniques/T1218/009/
    - https://docs.microsoft.com/en-us/windows/win32/ipc/named-pipes
    - https://hstechdocs.helpsystems.com/manuals/cobaltstrike/current/userguide/index.htm#cshid=1040
    - https://www.cobaltstrike.com/blog/learn-pipe-fitting-for-all-of-your-offense-projects/
    - https://gist.github.com/MHaggis/6c600e524045a6d49c35291a21e10752
    - https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations
drilldown_searches:
    - name: View the detection results for - "$dest$"
      search: '%original_detection_search% | search  dest = "$dest$"'
      earliest_offset: $info_min_time$
      latest_offset: $info_max_time$
    - name: View risk events for the last 7 days for - "$dest$"
      search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168  | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
      earliest_offset: $info_min_time$
      latest_offset: $info_max_time$
rba:
    message: An instance of $process_name$ was identified on endpoint $dest$ accessing known suspicious named pipes related to Cobalt Strike.
    risk_objects:
        - field: dest
          type: system
          score: 72
    threat_objects:
        - field: process_name
          type: process_name
tags:
    analytic_story:
        - Trickbot
        - DarkSide Ransomware
        - Cobalt Strike
        - BlackByte Ransomware
        - Graceful Wipe Out Attack
        - LockBit Ransomware
        - Gozi Malware
        - APT37 Rustonotto and FadeStealer
        - Hellcat Ransomware
    asset_type: Endpoint
    mitre_attack_id:
        - T1055
    product:
        - Splunk Enterprise
        - Splunk Enterprise Security
        - Splunk Cloud
    security_domain: endpoint
tests:
    - name: True Positive Test
      attack_data:
          - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log
            source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
            sourcetype: XmlWinEventLog
deprecation_info:
    reason: Detection is now part of a larger collection of suspicious named pipes
    removed_in_version: 5.22.0
    replacement_content:
        - Windows Suspicious C2 Named Pipe

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

085be70b-1776-4ec8-8a27-32392e4b586e

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion