topic Re: Named pipe hunting -Cortex XDR Pro in Cortex XDR Discussions

Named pipe hunting -Cortex XDR Pro

Cyber1985 — Sat, 05 Nov 2022 10:44:06 GMT

Hello dear community!

Is there a way to hunt for named pipe communication?

Rob

etugriceri — Mon, 07 Nov 2022 08:33:31 GMT

I believe you can use below XQL query.

preset = xdr_file
| filter event_type = ENUM.FILE and event_sub_type = ENUM.FILE_OPEN and action_file_path contains "\NamedPipe\"

mavraham — Mon, 07 Nov 2022 08:47:08 GMT

Hi,

Just to add on top of Emre's suggestion, you can check out this article.

Query #7 is used to hunt SolarWind breaches based on namedpipe.