Skip to content

Instantly share code, notes, and snippets.

@Samirbous

Samirbous/SharpNamedPipePTH

Created June 16, 2021 14:46
Show Gist options
  • Save Samirbous/0b1f6ff425f0bcb2329738f064fe7efc to your computer and use it in GitHub Desktop.
Save Samirbous/0b1f6ff425f0bcb2329738f064fe7efc to your computer and use it in GitHub Desktop.
Download ZIP
Raw
SharpNamedPipePTH
sequence by host.id with maxspan=1m
[authentication where event.action : "logged-in" and
event.outcome == "success" and user.id: "S-1-5-21-*" and
process.pid == 0 and
winlog.event_data.LogonProcessName:"NtLmSsp*"and
winlog.event_data.LogonType == 3 and source.ip == "127.0.0.1"] by winlog.event_data.TargetLogonId
[process where event.type == "start"] by winlog.event_data.TargetLogonId
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment