Sign In
- Platform
- Solutions
- Modern NDR
- Resources
- Company
Platform
Modern NDR
Resources
Platform
Modern NDR
Resources
DETECTION OVERVIEW
Risk Factors
SMB named pipe beaconing is associated with a persistent, planned attack rather than a random, opportunistic attack. A client and server on the network must already be compromised to enable an attacker to communicate data through a named pipe. A named pipe that delivers data for an attack tool does not adversely affect the network; however, this activity can indicate that an attacker is sending commands between internal devices on your network.
The system might change the risk score for this detection.
Kill Chain
Risk Score
67
SMB named pipes can help an attacker relay messages between multiple compromised devices on a network. A named pipe is a file that enables peer-to-peer communication by storing command output. An attacker can send a command between two compromised devices, but the attacker does not know how long it will take for the command to run. The pipe peek beacon checks to see if there is output available and alerts the attacker when there is command output that is ready to be read. A named pipe beacon does not confirm that an attacker has established a beacon to an external C&C server, but it does match activity that is associated with attack toolkits such as Cobalt Strike, which is often associated with malicious activity. A chain of compromised devices linked by named pipes can help the attacker move closer to their objective, such as gaining access to high-value assets and exfiltrating data.
Legitimate processes such as MSSQL will check the contents of a named pipe during communication with a client. However, a consistent pattern of checks on a new named pipe can indicate malicious beaconing activity.
Implement network segmentation, security zones, and firewall policies that limit how devices can communicate
