Lion Cipher Lab
Hunt anomalous named pipes in Sysmon pipe events (Event ID 17/18)
- SOC Analyst / Blue Team
- Advanced
- ~90 min
- Free · no account required
Why it matters
A named pipe is a little mailbox two Windows processes use to talk, on one machine or across the network over SMB. Windows itself runs on them, which is exactly why attackers like them: remote service execution, many lateral-movement tools and a lot of command-and-control software pass their traffic through pipes, where it looks like the operating system talking to itself. Sysmon can log every pipe a process creates, but a real fleet creates thousands of pipe names a day, most with random numbers in them, so the obvious hunt (look for rare names) hands you thousands of rare names. This lab…
What you'll learn
- Explaining what a Windows named pipe is, how it is named, and why lateral movement and peer-to-peer command-and-control use them
- Reading Sysmon Event ID 17 (pipe created) and 18 (pipe connected), and knowing they must be switched on in the Sysmon config
- Normalising volatile pipe names (GUIDs, process IDs, random hex) into templates so rarity means something
- Stacking (template, creating image) pairs across a fleet, and normalising per-user install paths the same way
- Ranking rare pairs by who created the pipe (LOLBins, user-writable folders) and by lookalikes of real RPC endpoint names
- Measuring rows-to-review against malicious pipes found, and naming what a pipe hunt cannot see
Steps in this lab
- What a named pipe is, and why attackers route through them
- The telemetry: Sysmon Event ID 17 and 18, and the config you need first
- Optional: look at the live pipes on your own PC (read-only)
- Build the synthetic week of pipe events
- Why rare names drown you, and how templates fix it
- Stack four ways and score each one
- Rank the eight rows by who made the pipe
- What each finding would mean, in ATT&CK terms
- What a pipe hunt cannot see
- Where this goes next