Detection: Cobalt Strike Named Pipes

REMOVED DETECTION

This detection has been removed from the Splunk Threat Research content library and is no longer maintained or supported.

Reason: Detection is now part of a larger collection of suspicious named pipes

Removed in version: 5.22.0

Replacement: Windows Suspicious C2 Named Pipe

If you have any questions or concerns, please reach out to us at research@splunk.com.

Updated Date: 2026-05-13 ID: 5876d429-0240-4709-8b93-ea8330b411b5 Author: Michael Haag, Splunk Type: TTP Product: Splunk Enterprise Security

Description

The following analytic detects the use of default or publicly known named pipes associated with Cobalt Strike. It leverages Sysmon EventID 17 and 18 to identify specific named pipes commonly used by Cobalt Strike's Artifact Kit and Malleable C2 Profiles. This activity is significant because Cobalt Strike is a popular tool for adversaries to conduct post-exploitation tasks, and identifying its named pipes can reveal potential malicious activity. If confirmed malicious, this could indicate an active Cobalt Strike beacon, leading to unauthorized access, data exfiltration, or further lateral movement within the network.

Search

 1`sysmon` (EventID=17 OR EventID=18)
 2PipeName IN (
 3  "\\DserNamePipe*",
 4  "\\interprocess_*",
 5  "\\lsarpc_*",
 6  "\\mojo_*",
 7  "\\msagent_*",
 8  "\\MSSE-*",
 9  "\\netlogon_*",
10  "\\ntsvcs*",
11  "\\postex_*",
12  "\\samr_*",
13  "\\spoolss_*",
14  "\\srvsvc_*",
15  "\\status_*",
16  "\\UIA_PIPE*",
17  "\\win_svc*",
18  "\\winsock*",
19  "\\wkssvc_*"
20)
21
22| stats count min(_time) as firstTime max(_time) as lastTime
23by dest dvc pipe_name process_exec process_guid process_id process_name process_path
24signature signature_id user_id vendor_product Image PipeName
25
26| `security_content_ctime(firstTime)`
27
28| `security_content_ctime(lastTime)`
29
30| `cobalt_strike_named_pipes_filter`

Data Source

Name	Platform	Sourcetype	Source
Sysmon EventID 17	Windows	`'XmlWinEventLog'`	`'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'`
Sysmon EventID 18	Windows	`'XmlWinEventLog'`	`'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'`

Macros Used

Name	Value
sysmon	`(source=WinEventLog:Microsoft-Windows-Sysmon/Operational OR source=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational OR source=Syslog:Linux-Sysmon/Operational)`
cobalt_strike_named_pipes_filter	``

cobalt_strike_named_pipes_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK

+ Kill Chain Phases

+ NIST

+ CIS

- Threat Actors

ID	Technique	Tactic
T1055	Process Injection	Privilege Escalation

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting	Value
Disabled	true
Cron Schedule	`N/A`
Earliest Time	`N/A`
Latest Time	`N/A`
Schedule Window	`N/A`
Creates Finding (Notable)	No
Creates Intermediate Finding (Risk Event)	No

TTP detections generate a Finding (Notable) and may generate Intermediate Findings (Risk Events) for associated entities.

Implementation

To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.

Known False Positives

The idea of using named pipes with Cobalt Strike is to blend in. Therefore, some of the named pipes identified and added may cause false positives. Filter by process name or pipe name to reduce false positives.

Associated Analytic Story

References

Detection Testing

Test Type	Status	Dataset	Source	Sourcetype
Validation	Not Applicable	N/A	N/A	N/A
Unit	Not Applicable	N/A	`N/A`	`N/A`
Integration	Not Applicable	N/A	`N/A`	`N/A`

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub |

Version: 13