ER rule to detect echo and pipe commands

[Buijspa]

Hi,

I would like to detect commands like this one :

cmd.exe /c echo 123 > \\.\pipe\6g789h

which is an artifact often used by Cobalt Strike beacon and Metasploit :

In other words, the rule will be used to identifying instances of Command Processor cmd.exe where the command line contains the keywords echo and pipe.

Thank you for your help!

Buijspa

[Daveb3d]

Because of how the OS interprets some stuff, you currently can't do it by command line, unfortunately. I'm pressing them on that a bit though.

This should cover you though where you can add known abused pipe names.

Rule {
    Process {
        Include OBJECT_NAME { -v ** }
    }
    Target {
        Match FILE {
			Include OBJECT_NAME { 
			-v "**pipe\\MSSE-*-server"
			-v "**pipe\\msagent_*"
			-v "**pipe\\postex_*"
			}
		Include -access "CONNECT_NAMED_PIPE"
		}	
    }
}

This might work for what you need too.. I haven't tested it, but would be curious as to the results:

Rule {
    Process {
        Include OBJECT_NAME { -v "cmd.exe" }
    }
    Target {
        Match FILE {
			Include OBJECT_NAME { 
			-v "**pipe\\**"
			}
		Include -access "CONNECT_NAMED_PIPE"
		}	
    }
}