mirror of
https://github.com/valitydev/SigmaHQ.git
synced 2024-11-06 01:15:17 +00:00
16 lines
780 B
YAML
16 lines
780 B
YAML
alert:
|
|
- debug
|
|
description: This detection excludes known namped pipes accessible remotely and notify on newly observed ones, may help to detect lateral movement and remote exec using named pipes
|
|
filter:
|
|
- query:
|
|
query_string:
|
|
query: ((data.win.system.eventID:"5145" AND share_name.keyword:\\*\\IPC$) AND (NOT (data.win.system.eventID:"5145" AND share_name.keyword:\\*\\IPC$ AND share_relative_target_name:("atsvc" OR "samr" OR "lsarpc" OR "winreg" OR "netlogon" OR "srvsvc" OR "protected_storage" OR "wkssvc" OR "browser" OR "netdfs" OR "svcctl" OR "spoolss" OR "ntsvcs" OR "LSM_API_service" OR "HydraLsPipe" OR "TermSrv_API_service" OR "MsFteWds"))))
|
|
index: wazuh-alerts-3.x-*
|
|
name: 52d8b0c6-53d6-439a-9e41-52ad442ad9ad_0
|
|
priority: 2
|
|
realert:
|
|
minutes: 0
|
|
type: any
|
|
|
|
|