Detects a Chinese hacktool from a disclosed toolset - file PipeCmd.exe

Hunt Hypothesis

This hunt hypothesis targets adversaries utilizing the PipeCmd.exe utility as part of a known Chinese threat actor’s toolkit to establish command and control or execute post-compromise tasks within Azure environments. Proactively hunting for this specific file in Azure Sentinel is critical because its presence often signals early-stage reconnaissance by sophisticated nation-state actors, allowing the SOC team to identify and isolate potential intrusions before they escalate into broader data exfiltration events.

YARA Rule

rule CN_Toolset_NTscan_PipeCmd {
	meta:
		description = "Detects a Chinese hacktool from a disclosed toolset - file PipeCmd.exe"
		author = "Florian Roth"
		reference = "http://qiannao.com/ls/905300366/33834c0c/"
		reference2 = "https://raw.githubusercontent.com/Neo23x0/Loki/master/signatures/thor-hacktools.yar"
		date = "2015/03/30"
		score = 70
		hash = "a931d65de66e1468fe2362f7f2e0ee546f225c4e"
	strings:
		$s2 = "Please Use NTCmd.exe Run This Program." fullword ascii
		$s3 = "PipeCmd.exe" fullword wide
		$s4 = "\\\\.\\pipe\\%s%s%d" fullword ascii
		$s5 = "%s\\pipe\\%s%s%d" fullword ascii
		$s6 = "%s\\ADMIN$\\System32\\%s%s" fullword ascii
		$s7 = "%s\\ADMIN$\\System32\\%s" fullword ascii
		$s9 = "PipeCmdSrv.exe" fullword ascii
		$s10 = "This is a service executable! Couldn't start directly." fullword ascii
		$s13 = "\\\\.\\pipe\\PipeCmd_communicaton" fullword ascii
		$s14 = "PIPECMDSRV" fullword wide
		$s15 = "PipeCmd Service" fullword ascii
	condition:
		4 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 11 string patterns in its detection logic.

References

• http://qiannao.com/ls/905300366/33834c0c/
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the PipeCmd.exe detection rule, including suggested filters or exclusions:

• Scenario: Legitimate IT Operations utilizing Sysinternals Suite for pipeline management.

  • Context: System administrators frequently use Sysinternals’ PsExec, Process Monitor, or custom PowerShell scripts that invoke PipeCmd.exe (often a wrapper for named pipes) to transfer logs or manage remote sessions across the network. This is common in patching windows or inventory scans.
  • Filter/Exclusion: Exclude processes where the parent process is powershell.exe or cmd.exe running under the Local System account, and the file path resides within a known administrative tools directory (e.g., C:\Tools\Sysinternals\).

• Scenario: Scheduled Maintenance Jobs for Database Backup and ETL.

  • Context: Enterprise Data Centers often run nightly scheduled tasks using SQL Server Integration Services (SSIS) or custom ETL pipelines that utilize named pipes for data streaming. These jobs frequently spawn PipeCmd.exe to handle inter-process communication between the database engine and backup agents.
  • Filter/Exclusion: Create an exclusion based on the Scheduled Task Name (e.g., containing “Backup”, “ETL”, or “DataSync”) and restrict the scope to specific service accounts (e.g., DOMAIN\svc-database-backup) rather than interactive user logins.

• Scenario: Deployment of Microsoft Endpoint Configuration Manager (SCCM/MECM) Agents.

  • Context: During software deployment or configuration updates, SCCM agents often utilize named pipes to communicate with the Distribution Point. The PipeCmd.exe process is frequently spawned by the SMS Agent Host (SMSAgentHostService) to facilitate command execution and status reporting between clients and the management point.