Detection: Windows RMM Named Pipe

Description

The following analytic detects the creation or connection to known suspicious named pipes, which is a technique often used by offensive tools. It leverages Sysmon EventCodes 17 and 18 to identify known default pipe names used by RMM tools. If confirmed malicious, this could allow an attacker to abuse these to potentially gain persistence, command and control, or further system compromise.

Search

 1`sysmon`
 2(EventCode=17 OR EventCode=18)
 3NOT process_path IN (
 4  "*:\\Program Files \(x86\)\\Adobe*",
 5  "*:\\Program Files \(x86\)\\Google*",
 6  "*:\\Program Files \(x86\)\\Microsoft*",
 7  "*:\\Program Files\\Adobe*",
 8  "*:\\Program Files\\Google*",
 9  "*:\\Program Files\\Microsoft*",
10  "*:\\Windows\\system32\\SearchIndexer.exe",
11  "*:\\Windows\\System32\\svchost.exe",
12  "*:\\Windows\\SystemApps\\Microsoft*",
13  "*\\Amazon\\SSM\\Instance*",
14  "*\\AppData\\Local\\Google*",
15  "*\\AppData\\Local\\Kingsoft\\*",
16  "*\\AppData\\Local\\Microsoft*",
17  "System"
18)
19
20
21| stats  min(_time) as firstTime max(_time) as lastTime
22count by dest dvc process_exec process_guid process_id process_path signature signature_id 
23vendor_product pipe_name user_id Image process_name
24
25
26| lookup suspicious_rmm_named_pipes suspicious_pipe_name AS pipe_name OUTPUT tool, description
27
28| where isnotnull(tool)
29
30| `security_content_ctime(firstTime)`
31
32| `security_content_ctime(lastTime)`
33
34| `windows_rmm_named_pipe_filter`

Data Source

Name	Platform	Sourcetype	Source
Sysmon EventID 17	Windows	'XmlWinEventLog'	'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'
Sysmon EventID 18	Windows	'XmlWinEventLog'	'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'

Macros Used

Annotations

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Implementation

To successfully implement this search, you need to be ingesting logs with the process name and pipename from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.

Known False Positives

Some false positives may occur from RMM software used in your environment. Apply filters based on known legitimate RMM software in your environment to reduce false positives.

Associated Analytic Story

• CISA AA24-241A

• Cactus Ransomware

• Command And Control

• GhostRedirector IIS Module and Rungan Backdoor

• Gozi Malware

• Insider Threat

• Interlock Ransomware

• Ransomware

• Remote Monitoring and Management Software

• Scattered Lapsus$ Hunters

• Scattered Spider

• Seashell Blizzard

Risk Based Analytics (RBA)

Risk Message:

An instance of $process_name$ located in $process_path$ was identified on endpoint $dest$ accessing known RMM named pipe $pipe_name$.

References

• https://attack.mitre.org/techniques/T1218/009/

• https://docs.microsoft.com/en-us/windows/win32/ipc/named-pipes

Detection Testing

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 1