title: EfsPotato Named Pipe
id: 637f689e-b4a5-4a86-be0e-0100a0a33ba2
status: experimental
description: Detects the pattern of a pipe name as used by the tool EfsPotato
references:
   - https://twitter.com/SBousseaden/status/1429530155291193354?s=20
   - https://github.com/zcgonvh/EfsPotato
date: 2021/08/23
author: Florian Roth
logsource:
   product: windows
   category: pipe_created
   definition: 'Note that you have to configure logging for PipeEvents in Sysmon config'
detection:
   selection:
      PipeName|contains: 
         - '\pipe\'
         - '\pipe\srvsvc'  # more specific version (use only this one of the other causes too many false positives)
   condition: selection
tags:
   - attack.defense_evasion
   - attack.privilege_escalation
   - attack.t1055
falsepositives:
   - Unknown
level: critical
