detection.wiki

Detection rules › Sigma

ADFS Database Named Pipe Connection By Uncommon Tool

Status
test
Severity
medium
Log source
product windows, category pipe_created
Author
Roberto Rodriguez @Cyb3rWard0g
Source
github.com/SigmaHQ/sigma

Detects suspicious local connections via a named pipe to the AD FS configuration database (Windows Internal Database). Used to access information such as the AD FS configuration settings which contains sensitive information used to sign SAML tokens.

MITRE ATT&CK coverage

TacticTechniques
CollectionT1005 Data from Local System

Event coverage

ProviderEventTitle
SysmonEvent ID 17PipeEvent (Pipe Created)
SysmonEvent ID 18PipeEvent (Pipe Connected)

Rule body yaml

title: ADFS Database Named Pipe Connection By Uncommon Tool
id: 1ea13e8c-03ea-409b-877d-ce5c3d2c1cb3
status: test
description: |
    Detects suspicious local connections via a named pipe to the AD FS configuration database (Windows Internal Database).
    Used to access information such as the AD FS configuration settings which contains sensitive information used to sign SAML tokens.
references:
    - https://github.com/Azure/Azure-Sentinel/blob/f99542b94afe0ad2f19a82cc08262e7ac8e1428e/Detections/SecurityEvent/ADFSDBNamedPipeConnection.yaml
    - https://o365blog.com/post/adfs/
    - https://github.com/Azure/SimuLand
author: Roberto Rodriguez @Cyb3rWard0g
date: 2021-10-08
modified: 2023-11-30
tags:
    - attack.collection
    - attack.t1005
logsource:
    product: windows
    category: pipe_created
    definition: 'Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575'
detection:
    selection:
        PipeName: '\MICROSOFT##WID\tsql\query'
    filter_main_generic:
        Image|endswith:
            - ':\Windows\System32\mmc.exe'
            - ':\Windows\system32\svchost.exe'
            - ':\Windows\System32\wsmprovhost.exe'
            - ':\Windows\SysWOW64\mmc.exe'
            - ':\Windows\SysWOW64\wsmprovhost.exe'
            - ':\Windows\WID\Binn\sqlwriter.exe'
            - '\AzureADConnect.exe'
            - '\Microsoft.Identity.Health.Adfs.PshSurrogate.exe'
            - '\Microsoft.IdentityServer.ServiceHost.exe'
            - '\Microsoft.Tri.Sensor.exe'
            - '\sqlservr.exe'
            - '\tssdis.exe'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unknown
level: medium

Stages and Predicates

Stage 0: condition

selection and not 1 of filter_main_*

Stage 1: selection

selection:
    PipeName: '\MICROSOFT##WID\tsql\query'

Stage 2: not filter_main_generic

filter_main_generic:
    Image|endswith:
        - ':\Windows\System32\mmc.exe'
        - ':\Windows\system32\svchost.exe'
        - ':\Windows\System32\wsmprovhost.exe'
        - ':\Windows\SysWOW64\mmc.exe'
        - ':\Windows\SysWOW64\wsmprovhost.exe'
        - ':\Windows\WID\Binn\sqlwriter.exe'
        - '\AzureADConnect.exe'
        - '\Microsoft.Identity.Health.Adfs.PshSurrogate.exe'
        - '\Microsoft.IdentityServer.ServiceHost.exe'
        - '\Microsoft.Tri.Sensor.exe'
        - '\sqlservr.exe'
        - '\tssdis.exe'

Exclusions

Top-level NOT(...) conjuncts: predicates this rule actively suppresses.

FieldKindExcluded values
Imageends_with:\Windows\SysWOW64\mmc.exe
Imageends_with:\Windows\SysWOW64\wsmprovhost.exe
Imageends_with:\Windows\System32\mmc.exe
Imageends_with:\Windows\System32\wsmprovhost.exe
Imageends_with:\Windows\WID\Binn\sqlwriter.exe
Imageends_with:\Windows\system32\svchost.exe
Imageends_with\AzureADConnect.exe
Imageends_with\Microsoft.Identity.Health.Adfs.PshSurrogate.exe
Imageends_with\Microsoft.IdentityServer.ServiceHost.exe
Imageends_with\Microsoft.Tri.Sensor.exe
Imageends_with\sqlservr.exe
Imageends_with\tssdis.exe

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
PipeNameeq
  • \MICROSOFT##WID\tsql\query