Skip to content

Hide Navigation Hide TOC

First Time Seen Remote Named Pipe (52d8b0c6-53d6-439a-9e41-52ad442ad9ad)

This detection excludes known namped pipes accessible remotely and notify on newly observed ones, may help to detect lateral movement and remote exec using named pipes

Cluster A Galaxy A Cluster B Galaxy B Level
SMB/Windows Admin Shares - T1021.002 (4f9ca633-15c5-463c-9724-bdcd54fde541) Attack Pattern First Time Seen Remote Named Pipe (52d8b0c6-53d6-439a-9e41-52ad442ad9ad) Sigma-Rules 1
SMB/Windows Admin Shares - T1021.002 (4f9ca633-15c5-463c-9724-bdcd54fde541) Attack Pattern Remote Services - T1021 (54a649ff-439a-41a4-9856-8d144a2551ba) Attack Pattern 2