Skip to main content

​
Summary

An attacker may enumerate PXE configurations or primary (including CAS) and secondary site configuration information via the winreg named pipe (\\.\pipe\winreg). The winreg named pipe is used by Windows for remote access to the Windows registry. The use of the named pipe in an environment may be an anomaly in and of itself. The following is an example of RECON-6 SMB Winreg named pipe enumeration.
Defenders can leverage several assumptions to identify the connections to the winreg named pipe and reduce false positives:
  1. The connection will be made from an attacker controlled host
  2. The connection will target Tier0 infrastructure or a Distribution Point
To identify connections to the winreg named pipe, defenders can create composite events based on the source network connection Sysmon Event ID: 3 referencing destination port 445 and the name of the Tier 0, Primary (including CAS) or Secondary site servers, in combination with the destination Sysmon Event ID: 18 winreg named pipe connection. The below Sysmon Event ID: 3 (Source host) displays the connection to a site server over destination port 445:
The above event would need to be combined with a destination Sysmon Event ID: 18 named pipe connection:
Additionally, defenders can enable detailed file access auditing (either for the entire domain (GPO) or local group policy). Enabling this audit category will generate an Windows Security Event ID: 5145 detailed file share access event that displays the winreg named pipe connection and the source host that the connection originated from. Proxied execution of offensive tooling will still generate these event IDs. The below Windows Security Detailed File Share Access Event ID: 5145 which will display the connection to the winreg named pipe:

​
Associated Offensive IDs

​
References