First Time Seen Remote Named Pipe - Zeek

Title: First Time Seen Remote Named Pipe - Zeek
Status: test
Description:This detection excludes known namped pipes accessible remotely and notify on newly observed ones, may help to detect lateral movement and remote exec using named pipes
References:
  -https://twitter.com/menasec1/status/1104489274387451904
Author: Samir Bousseaden, @neu5ron, Tim Shelton
Date: 2020-04-02
modified:2022-12-27
Tags:

• -'attack.lateral-movement'
• -'attack.t1021.002'

Logsource:

• product: zeek
• service: smb_files

Detection:
  selection:
    path: '\\\\\*\\IPC$'
  filter_keywords:
    - 'samr'
    - 'lsarpc'
    - 'winreg'
    - 'netlogon'
    - 'srvsvc'
    - 'protected_storage'
    - 'wkssvc'
    - 'browser'
    - 'netdfs'
    - 'svcctl'
    - 'spoolss'
    - 'ntsvcs'
    - 'LSM_API_service'
    - 'HydraLsPipe'
    - 'TermSrv_API_service'
    - 'MsFteWds'
  condition:selection and not 1 of filter_*
Falsepositives:
  -Update the excluded named pipe to filter out any newly observed legit named pipe
Level: high