Named pipe hunting -Cortex XDR Pro

[Cyber1985]

Hello dear community! 

Is there a way to hunt for named pipe communication? 

BR

Rob

https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575

[etugriceri]

Hi @Cyber1985 

I believe you can use below XQL query. 

preset = xdr_file
| filter event_type = ENUM.FILE and event_sub_type = ENUM.FILE_OPEN and action_file_path contains "\NamedPipe\"

[mavraham]

Hi,

Just to add on top of Emre's suggestion, you can check out this article.

Query #7 is used to hunt SolarWind breaches based on namedpipe.