Open WojciechLesicki opened 3 years ago
Hi, According Cobalt Strike documentation (https://blog.cobaltstrike.com/2021/02/09/learn-pipe-fitting-for-all-of-your-offense-projects/) and some test I suggest to add a named pipe used by Cobalt Strike.
Take into account widely Cobalt Strike is used today, adding this could be useful for all of us. Some reports about Cobalt Strike from 2020: https://content.fireeye.com/m-trends/rpt-m-trends-2021 (page 26) https://redcanary.com/threat-detection-report/ (page 84)
I wanted to point out that the basic config is from Olaf Hartong (https://github.com/olafhartong/sysmon-modular/blob/master/17_18_pipe_event/include_cobaltstrike.xml) I added extra pipe and fixed one bug, extra info in PR: https://github.com/olafhartong/sysmon-modular/pull/97
Hi, According Cobalt Strike documentation (https://blog.cobaltstrike.com/2021/02/09/learn-pipe-fitting-for-all-of-your-offense-projects/) and some test I suggest to add a named pipe used by Cobalt Strike.
Take into account widely Cobalt Strike is used today, adding this could be useful for all of us. Some reports about Cobalt Strike from 2020: https://content.fireeye.com/m-trends/rpt-m-trends-2021 (page 26) https://redcanary.com/threat-detection-report/ (page 84)
I wanted to point out that the basic config is from Olaf Hartong (https://github.com/olafhartong/sysmon-modular/blob/master/17_18_pipe_event/include_cobaltstrike.xml) I added extra pipe and fixed one bug, extra info in PR: https://github.com/olafhartong/sysmon-modular/pull/97