Admin share remote exec pipe
A remote client opened one of the named pipes over IPC$ that grant control of the machine rather than access to data.
What it detects
A remote client opened one of the named pipes over IPC$ that grant control of the machine rather than access to data. These are the pipes behind the standard remote-execution and coercion toolkits:
* svcctl — the Service Control Manager. Creating and starting a service remotely is how PsExec, RemCom, smbexec and Impacket obtain SYSTEM. * atsvc — remote scheduled-task creation (at/schtasks). * winreg — the Remote Registry service; remote hive reads and writes. * spoolss — the print spooler. Not used for printing here: this is the "PrinterBug"/SpoolSample coercion that forces a machine account to authenticate to an attacker-chosen host, feeding NTLM relay to AD CS. * efsrpc — the same coercion via the Encrypting File System RPC interface, which is PetitPotam. * protected_storage — the DPAPI backup-key interface on a domain controller. Reading it yields the domain backup key, which decrypts EVERY user's DPAPI secrets domain-wide: saved browser passwords, credential-manager entries and certificate private keys. There is no client-side reason to open this pipe.
Ordinary file access over SMB does not touch any of these. Normal session bookkeeping pipes (srvsvc, wkssvc, MsFteWds) are deliberately excluded so routine share browsing does not alert.
Matching is against the field-qualified rendering in the normalized message rather than a raw payload path, because Windows 5145 arrives with two different EventData shapes depending on whether it was exported by wevtutil or read from a binary .evtx, and a payload path that works for one silently fails on the other.
MITRE ATT&CK mapping
False positives and triage
Legitimate administration uses these same pipes — remote service management from a jump box, backup agents, monitoring, and vulnerability scanners (which will light up svcctl and winreg across the estate on a schedule).
To confirm: the source is in IpAddress. Ask whether that host administers this one. Broad fan-out from one source to many destinations in a short window is a scanner or an operator sweeping the network — distinguish the two by the account used. spoolss and efsrpc deserve separate treatment: they have almost no administrative use, and a hit from a workstation should be treated as coercion, with the destination of the forced authentication as the next thing to find.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 75%. Source: rules/windows/admin_share_remote_exec_pipe.yaml, licensed under the Apache License 2.0.
id: windows.lateral_movement.admin_share_remote_exec_pipe
version: 1.1.0
status: stable
severity: high
confidence: 0.75
platforms: [windows]
mitre_techniques: [T1021.002, T1570]
description: |
A remote client opened one of the named pipes over `IPC$` that grant control of
the machine rather than access to data. These are the pipes behind the standard
remote-execution and coercion toolkits:
* `svcctl` — the Service Control Manager. Creating and starting a service
remotely is how PsExec, RemCom, smbexec and Impacket obtain SYSTEM.
* `atsvc` — remote scheduled-task creation (`at`/schtasks).
* `winreg` — the Remote Registry service; remote hive reads and writes.
* `spoolss` — the print spooler. Not used for printing here: this is the
"PrinterBug"/SpoolSample coercion that forces a machine account to
authenticate to an attacker-chosen host, feeding NTLM relay to AD CS.
* `efsrpc` — the same coercion via the Encrypting File System RPC interface,
which is PetitPotam.
* `protected_storage` — the DPAPI backup-key interface on a domain controller.
Reading it yields the domain backup key, which decrypts EVERY user's DPAPI
secrets domain-wide: saved browser passwords, credential-manager entries and
certificate private keys. There is no client-side reason to open this pipe.
Ordinary file access over SMB does not touch any of these. Normal session
bookkeeping pipes (`srvsvc`, `wkssvc`, `MsFteWds`) are deliberately excluded so
routine share browsing does not alert.
Matching is against the field-qualified rendering in the normalized message rather
than a raw payload path, because Windows 5145 arrives with two different EventData
shapes depending on whether it was exported by wevtutil or read from a binary
.evtx, and a payload path that works for one silently fails on the other.
match:
native_event_id: '5145'
raw_message_contains_any:
- 'RelativeTargetName=svcctl'
- 'RelativeTargetName=atsvc'
- 'RelativeTargetName=winreg'
- 'RelativeTargetName=spoolss'
- 'RelativeTargetName=efsrpc'
- 'RelativeTargetName=eventlog'
- 'RelativeTargetName=samr'
- 'RelativeTargetName=lsarpc'
- 'RelativeTargetName=protected_storage'
correlation_keys: [hostname, source_ip]
false_positive_guidance: |
Legitimate administration uses these same pipes — remote service management from a
jump box, backup agents, monitoring, and vulnerability scanners (which will light
up `svcctl` and `winreg` across the estate on a schedule).
To confirm: the source is in `IpAddress`. Ask whether that host administers this
one. Broad fan-out from one source to many destinations in a short window is a
scanner or an operator sweeping the network — distinguish the two by the account
used. `spoolss` and `efsrpc` deserve separate treatment: they have almost no
administrative use, and a hit from a workstation should be treated as coercion,
with the destination of the forced authentication as the next thing to find.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.