hard20 pts · first answer countsdetection-engineeringthreat-intelligencesysmon
How durable is a named pipe rule
A report says an actor's Cobalt Strike beacons use default named pipes like `\msagent_*`. You build a Sysmon pipe event (17/18) rule for it. How durable is this detection?
Discussion 0
Join free to post in the discussion.
Related questions
- IOC vs IOACybersecurity Analyst
- False positive or false negative?Cybersecurity Analyst
- What is Sysmon Event ID 1?Cybersecurity Analyst
- Safe use of VirusTotalCybersecurity Analyst
- What detection as code gives youCybersecurity Analyst
- The logsource block in a Sigma ruleCybersecurity Analyst
- Reading a selection and filter conditionCybersecurity Analyst
- What the contains modifier doesCybersecurity Analyst