rule: EfsPotato Named Pipe

rules/windows/pipe_created/sysmon_efspotato_namedpipe.yml

@@ -0,0 +1,24 @@
+title: EfsPotato Named Pipe
+id: 637f689e-b4a5-4a86-be0e-0100a0a33ba2
+status: experimental
+description: Detects the pattern of a pipe name as used by the tool EfsPotato
+references:
+    - https://twitter.com/SBousseaden/status/1429530155291193354?s=20
+    - https://github.com/zcgonvh/EfsPotato
+date: 2021/08/23
+author: Florian Roth
+logsource:
+   product: windows
+   category: pipe_created
+   definition: 'Note that you have to configure logging for PipeEvents in Sysmon config'
+detection:
+   selection:
+      PipeName|contains: '\pipe\'
+   condition: selection
+tags:
+    - attack.defense_evasion
+    - attack.privilege_escalation
+    - attack.t1055
+falsepositives:
+   - Unknown
+level: critical