update ident and metdata

Author: nasbench

detections/endpoint/windows_suspicious_named_pipe.yml

@@ -5,89 +5,104 @@ date: '2025-12-01'
 author: Raven Tait, Splunk
 status: production
 type: TTP
-description: The following analytic detects the creation or connection to
-  known suspicious named pipes, which is a technique often used by offensive
-  tools. It leverages Sysmon EventCodes 17 and 18 to identify 
-  known default pipe names used by these tools. If confirmed malicious, 
-  this could allow an attacker to abuse these to potentially gain privilege escalation, 
+description: |
+  The following analytic detects the creation or connection to a known suspicious named pipe.
+  It leverages Sysmon EventCodes 17 and 18 to identify known default pipe names used by these attacker or malicious tools.
+  If confirmed malicious, this could allow an attacker to abuse these to potentially gain privilege escalation, 
   persistence, c2 communications, or further system compromise.
 data_source:
-- Sysmon EventID 17
-- Sysmon EventID 18
-search: '`sysmon` EventCode=17 OR EventCode=18 AND NOT Image IN (
-    "System","*System32\\svchost.exe","*Program Files*\\Microsoft*","*Program Files*\\Google*",
-    "*AppData\\Local\\Microsoft*","*AppData\\Local\\Google*","*AppData\\Local\\Kingsoft\\*",
-    "*\\Windows\\system32\\SearchIndexer.exe","*\\WINDOWS\\SystemApps\\Microsoft*",
-    "*Program Files\\dotnet\\dotnet.exe","*Program Files*\\Adobe*","*Amazon\\SSM\\Instance*"
+  - Sysmon EventID 17
+  - Sysmon EventID 18
+search: |
+  `sysmon`
+  EventCode IN (17, 18)
+  NOT Image IN (
+      "*:\\Program Files*\\Adobe*",
+      "*:\\Program Files*\\Google*",
+      "*:\\Program Files*\\Microsoft*",
+      "*:\\Program Files\\dotnet\\dotnet.exe",
+      "*:\\Windows\\system32\\SearchIndexer.exe",
+      "*:\\Windows\\System32\\svchost.exe",
+      "*:\\Windows\\SystemApps\\Microsoft*",
+      "*\\Amazon\\SSM\\Instance*",
+      "*\\AppData\\Local\\Google*",
+      "*\\AppData\\Local\\Kingsoft\\*",
+      "*\\AppData\\Local\\Microsoft*",
+      "System",
   )
-  | stats  min(_time) as firstTime max(_time) as lastTime
-  count by dest dvc process_exec process_guid process_id process_path signature signature_id 
-  vendor_product pipe_name user_id Image process_name
+  
+  | stats min(_time) as firstTime max(_time) as lastTime
+    count by dest dvc process_exec process_guid process_id process_path
+             pipe_name user_id process_name signature signature_id vendor_product
+  
   | lookup suspicious_named_pipes suspicious_pipe_name AS pipe_name OUTPUT tool, type, description
-  | where isnotnull(tool) | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
-  | `windows_suspicious_named_pipe_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name and pipename from your endpoints. If you are using Sysmon,
-  you must have at least version 6.0.4 of the Sysmon TA.
-known_false_positives: Some named pipes will attempt to blend
-  in. Therefore, some of the named pipes identified and added may cause false positives.
+  | where isnotnull(tool)
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `windows_suspicious_named_pipe_filter`
+how_to_implement: |
+  To successfully implement this search, you need to be ingesting
+  logs with the process name and pipename from your endpoints.
+  If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+known_false_positives: |
+  Some named pipes will attempt to blend in.
+  Therefore, some of the named pipes identified and added may cause false positives.
   Filter by process name or pipe name to reduce false positives.
 references:
-- https://attack.mitre.org/techniques/T1218/009/
-- https://docs.microsoft.com/en-us/windows/win32/ipc/named-pipes
+  - https://attack.mitre.org/techniques/T1218/009/
+  - https://docs.microsoft.com/en-us/windows/win32/ipc/named-pipes
 drilldown_searches:
-- name: View the detection results for - "$dest$"
-  search: '%original_detection_search% | search  dest = "$dest$"'
-  earliest_offset: $info_min_time$
-  latest_offset: $info_max_time$
-- name: View risk events for the last 7 days for - "$dest$"
-  search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
-    starthoursago=168  | stats count min(_time) as firstTime max(_time) as lastTime
-    values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
-    as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
-    as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
-    | `security_content_ctime(lastTime)`'
-  earliest_offset: $info_min_time$
-  latest_offset: $info_max_time$
+  - name: View the detection results for - "$dest$"
+    search: '%original_detection_search% | search  dest = "$dest$"'
+    earliest_offset: $info_min_time$
+    latest_offset: $info_max_time$
+  - name: View risk events for the last 7 days for - "$dest$"
+    search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
+      starthoursago=168  | stats count min(_time) as firstTime max(_time) as lastTime
+      values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
+      as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
+      as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
+      | `security_content_ctime(lastTime)`'
+    earliest_offset: $info_min_time$
+    latest_offset: $info_max_time$
 rba:
-  message: An instance of $process_name$ was identified on endpoint $dest$ accessing
-    known suspicious named pipes.
+  message: An instance of $process_name$ located in $process_path$ was identified on endpoint $dest$ accessing
+    known suspicious named pipes $pipe_name$.
   risk_objects:
-  - field: dest
-    type: system
-    score: 72
+    - field: dest
+      type: system
+      score: 72
   threat_objects:
-  - field: process_name
-    type: process_name
+    - field: process_name
+      type: process_name
 tags:
   analytic_story:
-  - Trickbot
-  - DarkSide Ransomware
-  - Cobalt Strike
-  - BlackByte Ransomware
-  - Graceful Wipe Out Attack
-  - LockBit Ransomware
-  - Gozi Malware
-  - APT37 Rustonotto and FadeStealer
-  - Hellcat Ransomware
-  - Meterpreter
-  - Brute Ratel C4
-  - Remote Monitoring and Management Software
-  - Tuoni
+    - Trickbot
+    - DarkSide Ransomware
+    - Cobalt Strike
+    - BlackByte Ransomware
+    - Graceful Wipe Out Attack
+    - LockBit Ransomware
+    - Gozi Malware
+    - APT37 Rustonotto and FadeStealer
+    - Hellcat Ransomware
+    - Meterpreter
+    - Brute Ratel C4
+    - Remote Monitoring and Management Software
+    - Tuoni
   asset_type: Endpoint
   mitre_attack_id:
-  - T1559
-  - T1021.002
-  - T1055
+    - T1559
+    - T1021.002
+    - T1055
   product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
   security_domain: endpoint
 tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: XmlWinEventLog
-
+  - name: True Positive Test
+    attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log
+      source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+      sourcetype: XmlWinEventLog