Merge pull request #1103 from splunk/default_named_pipes

RavenTait · web-flow · commit ff9fe66dda90 · 2025-12-05T14:16:44.000-05:00
Add attack data for named pipes used by tools
diff --git a/datasets/attack_techniques/T1055/named_pipes/named_pipes.yml b/datasets/attack_techniques/T1055/named_pipes/named_pipes.yml
@@ -0,0 +1,14 @@
+author: Raven Tait, Splunk
+id: e7dc3e89-157f-41bc-97d3-9161fa9a5620
+date: '2025-12-05'
+description: Manual generation of attack data to generate default
+  named pipes associated with offensive tools.
+environment: custom
+directory: named_pipes
+mitre_technique:
+- T1055
+datasets:
+- name: windows-sysmon
+  path: /datasets/attack_techniques/T1055/named_pipes/windows-sysmon.log
+  sourcetype: XmlWinEventLog
+  source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
diff --git a/datasets/attack_techniques/T1055/named_pipes/windows-sysmon.log b/datasets/attack_techniques/T1055/named_pipes/windows-sysmon.log
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:5787440e8de0d873a6d32e5f68e65517b1f3efa0531f312351743847a4746beb
+size 38570

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+version https://git-lfs.github.com/spec/v1`
	`2`	`+oid sha256:5787440e8de0d873a6d32e5f68e65517b1f3efa0531f312351743847a4746beb`
	`3`	`+size 38570`