From 756431d654d424937a606e52a4c3ea87a1ee783b Mon Sep 17 00:00:00 2001
From: swachchhanda000 <swachchhandashrawan@gmail.com>
Date: Mon, 24 Mar 2025 10:34:23 +0545
Subject: [PATCH 1/8] Added new named pipes

---
 sysmonconfig-export-block.xml | 30 ++++++++++++++++++++++++++----
 sysmonconfig-export.xml       | 29 ++++++++++++++++++++++++++---
 2 files changed, 52 insertions(+), 7 deletions(-)

diff --git a/sysmonconfig-export-block.xml b/sysmonconfig-export-block.xml
index 00cf2ae8..f7a481ed 100644
--- a/sysmonconfig-export-block.xml
+++ b/sysmonconfig-export-block.xml
@@ -946,7 +946,6 @@
 				<PipeName condition="begin with">\netlogon_</PipeName>
 				<PipeName condition="begin with">\srvsvc_</PipeName>
 				<PipeName condition="begin with">\lsarpc_</PipeName>
-				<PipeName condition="begin with">\wkssvc_</PipeName>
 				<!-- Havoc C2 default -->
 				<PipeName condition="begin with">\demon_pipe</PipeName>
 				<!-- Malleable C2 profiles https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575 -->
@@ -957,8 +956,6 @@
 				<PipeName condition="begin with">\mypipe-f</PipeName>
 				<PipeName condition="begin with">\mypipe-h</PipeName>
 				<PipeName condition="begin with">\windows.update.manager</PipeName>
-				<PipeName condition="begin with">\ntsvcs_</PipeName>
-				<PipeName condition="begin with">\scerpc_</PipeName>
 				<!-- Malleable C2 profiles https://gist.github.com/MHaggis/6c600e524045a6d49c35291a21e10752 -->
 				<PipeName condition="begin with">\demoagent_</PipeName>
 				<PipeName condition="begin with">\PGMessagePipe</PipeName>
@@ -970,6 +967,7 @@
 				<PipeName condition="begin with">\f53f</PipeName>
 				<PipeName condition="begin with">\rpc_</PipeName>
 				<PipeName condition="begin with">\spoolss_</PipeName>
+                <PipeName condition="begin with">\Winsock2\CatalogChangeListener</PipeName>
 				<PipeName condition="begin with">\win_svc</PipeName>
 				<PipeName condition="begin with">\SearchTextHarvester</PipeName>
 				<PipeName condition="begin with">\adschemerpc</PipeName> <!-- Turla HyperStack - https://www.accenture.com/us-en/blogs/cyber-defense/turla-belugasturgeon-compromises-government-entity -->
@@ -977,7 +975,15 @@
 				<PipeName condition="begin with">\bc367</PipeName> <!-- Pacifier - https://download.bitdefender.com/resources/files/News/CaseStudies/study/115/Bitdefender-Whitepaper-PAC-A4-en-EN1.pdf -->
 				<PipeName condition="begin with">\bc31a7</PipeName> <!-- Pacifier - https://download.bitdefender.com/resources/files/News/CaseStudies/study/115/Bitdefender-Whitepaper-PAC-A4-en-EN1.pdf -->
 				<PipeName condition="begin with">\testPipe</PipeName> <!-- Emissary Panda Hyerbri - https://unit42.paloaltonetworks.com/emissary-panda-attacks-middle-east-government-sharepoint-servers/ -->
-				<!-- these are standard pipes that appear frequently but the Sigma rules use RE to match on malicious pipes that use the common names as a prefix -->
+				<PipeName condition="begin with">\demoagent_</PipeName>
+                <!--RMM Pipe-->
+                <PipeName condition="is">\adprinterpipe</PipeName>
+                <!--Suspicious Location of Image-->
+                <Image condition="contains">:\PerfLogs\</Image>
+                <Image condition="contains">:\Users\Public\</Image>
+                <Image condition="contains">:\Windows\System32\Tasks\</Image>
+                <Image condition="contains">:\Windows\Tasks\</Image>
+                <!-- these are standard pipes that appear frequently but the Sigma rules use RE to match on malicious pipes that use the common names as a prefix -->
 				<PipeName condition="begin with">\scerpc</PipeName>
 				<PipeName condition="begin with">\ntsvcs</PipeName>
 				<PipeName condition="begin with">\wkssvc</PipeName>
@@ -987,6 +993,14 @@
 				<Rule groupRelation="and"> <!-- Some interesting ConnectPipe events that we want to include -->
 					<EventType condition="is">ConnectPipe</EventType>
 					<PipeName condition="is">\MICROSOFT##WID\tsql\query</PipeName> <!-- https://github.com/SigmaHQ/sigma/pull/2128 -->
+                <PipeName condition="contains">\coerced\</PipeName> <!--https://blog.hackvens.fr/articles/CoercedPotato.html-->
+                <PipeName condition="contains">thisispipe</PipeName> <!-- DiagTrackEoP Default Named Pipe-->
+                <PipeName condition="contains">\pipe\</PipeName> <!--EfsPotato Named Pipe Creation-->
+                <PipeName condition="contains any">\imposecost;\imposingcost</PipeName> <!--Koh Default Named Pipe-->
+                <PipeName condition="begin with">\PAExec</PipeName> <!--PAExec default named pipe-->
+                <PipeName condition="contains">\RemCom</PipeName> <!--RemCom Default Named Pipe-->
+                <PipeName condition="contains">\PSEXESVC</PipeName> <!--PsExec Tool PipeName-->
+                <PipeName condition="contains">\PSEXECSVC</PipeName> <!--Implementation of PsExec in another form like python, CSharp etc-->
 				</Rule>
 			</PipeEvent>
 		</RuleGroup>
@@ -997,6 +1011,14 @@
 				<PipeName condition="is">\scerpc</PipeName>
 				<PipeName condition="is">\ntsvcs</PipeName>
 				<PipeName condition="is">\wkssvc</PipeName>
+                <PipeName condition="is">\MsFteWds</PipeName>
+                <PipeName condition="is">\PGMessagePipe</PipeName>
+                <PipeName condition="is">\SearchTextHarvester</PipeName>
+                <PipeName condition="is">\spoolss</PipeName>
+                <PipeName condition="is">\srvsvc</PipeName>
+                <!--Aurora Default Pipe-->
+                <Image condition="end with">\aurora-agent-64.exe</Image>
+                <Image condition="end with">\aurora-agent.exe</Image>
 			</PipeEvent>
 		</RuleGroup>
 
diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index 056b4171..a5453e1e 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -990,7 +990,6 @@
 				<PipeName condition="begin with">\netlogon_</PipeName>
 				<PipeName condition="begin with">\srvsvc_</PipeName>
 				<PipeName condition="begin with">\lsarpc_</PipeName>
-				<PipeName condition="begin with">\wkssvc_</PipeName>
 				<!-- Havoc C2 default -->
 				<PipeName condition="begin with">\demon_pipe</PipeName>
 				<!-- Malleable C2 profiles https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575 -->
@@ -1001,8 +1000,6 @@
 				<PipeName condition="begin with">\mypipe-f</PipeName>
 				<PipeName condition="begin with">\mypipe-h</PipeName>
 				<PipeName condition="begin with">\windows.update.manager</PipeName>
-				<PipeName condition="begin with">\ntsvcs_</PipeName>
-				<PipeName condition="begin with">\scerpc_</PipeName>
 				<!-- Malleable C2 profiles https://gist.github.com/MHaggis/6c600e524045a6d49c35291a21e10752 -->
 				<PipeName condition="begin with">\demoagent_</PipeName>
 				<PipeName condition="begin with">\PGMessagePipe</PipeName>
@@ -1014,6 +1011,7 @@
 				<PipeName condition="begin with">\f53f</PipeName>
 				<PipeName condition="begin with">\rpc_</PipeName>
 				<PipeName condition="begin with">\spoolss_</PipeName>
+                <PipeName condition="begin with">\Winsock2\CatalogChangeListener</PipeName>
 				<PipeName condition="begin with">\win_svc</PipeName>
 				<PipeName condition="begin with">\SearchTextHarvester</PipeName>
 				<PipeName condition="begin with">\adschemerpc</PipeName> <!-- Turla HyperStack - https://www.accenture.com/us-en/blogs/cyber-defense/turla-belugasturgeon-compromises-government-entity -->
@@ -1021,6 +1019,15 @@
 				<PipeName condition="begin with">\bc367</PipeName> <!-- Pacifier - https://download.bitdefender.com/resources/files/News/CaseStudies/study/115/Bitdefender-Whitepaper-PAC-A4-en-EN1.pdf -->
 				<PipeName condition="begin with">\bc31a7</PipeName> <!-- Pacifier - https://download.bitdefender.com/resources/files/News/CaseStudies/study/115/Bitdefender-Whitepaper-PAC-A4-en-EN1.pdf -->
 				<PipeName condition="begin with">\testPipe</PipeName> <!-- Emissary Panda Hyerbri - https://unit42.paloaltonetworks.com/emissary-panda-attacks-middle-east-government-sharepoint-servers/ -->
+                <PipeName condition="begin with">\demoagent_</PipeName>
+                <!--RMM Pipe-->
+                <PipeName condition="is">\adprinterpipe</PipeName>
+                <!--Suspicious Location of Image-->
+                <Image condition="contains">:\PerfLogs\</Image>
+                <Image condition="contains">:\Users\Public\</Image>
+                <Image condition="contains">:\Windows\System32\Tasks\</Image>
+                <Image condition="contains">:\Windows\Tasks\</Image>
+                <Image condition="contains">\Microsoft\Windows\Start Menu\Programs\Startup\</Image>
 				<!-- these are standard pipes that appear frequently but the Sigma rules use RE to match on malicious pipes that use the common names as a prefix -->
 				<PipeName condition="begin with">\scerpc</PipeName>
 				<PipeName condition="begin with">\ntsvcs</PipeName>
@@ -1032,6 +1039,14 @@
 					<EventType condition="is">ConnectPipe</EventType>
 					<PipeName condition="is">\MICROSOFT##WID\tsql\query</PipeName> <!-- https://github.com/SigmaHQ/sigma/pull/2128 -->
 				</Rule>
+                <PipeName condition="contains">\coerced\</PipeName> <!--https://blog.hackvens.fr/articles/CoercedPotato.html-->
+                <PipeName condition="contains">thisispipe</PipeName> <!-- DiagTrackEoP Default Named Pipe-->
+                <PipeName condition="contains">\pipe\</PipeName> <!--EfsPotato Named Pipe Creation-->
+                <PipeName condition="contains any">\imposecost;\imposingcost</PipeName> <!--Koh Default Named Pipe-->
+                <PipeName condition="begin with">\PAExec</PipeName> <!--PAExec default named pipe-->
+                <PipeName condition="contains">\RemCom</PipeName> <!--RemCom Default Named Pipe-->
+                <PipeName condition="contains">\PSEXESVC</PipeName> <!--PsExec Tool PipeName-->
+                <PipeName condition="contains">\PSEXECSVC</PipeName> <!--Implementation of PsExec in another form like python, CSharp etc-->
 			</PipeEvent>
 		</RuleGroup>
 		<!-- Common Pipe Names to would appear very often in -->
@@ -1041,6 +1056,14 @@
 				<PipeName condition="is">\scerpc</PipeName>
 				<PipeName condition="is">\ntsvcs</PipeName>
 				<PipeName condition="is">\wkssvc</PipeName>
+                <PipeName condition="is">\MsFteWds</PipeName>
+                <PipeName condition="is">\PGMessagePipe</PipeName>
+                <PipeName condition="is">\SearchTextHarvester</PipeName>
+                <PipeName condition="is">\spoolss</PipeName>
+                <PipeName condition="is">\srvsvc</PipeName>
+                <!--Aurora Default Pipe-->
+                <Image condition="end with">\aurora-agent-64.exe</Image>
+                <Image condition="end with">\aurora-agent.exe</Image>
 			</PipeEvent>
 		</RuleGroup>
 

From ce3790794c0db44f80380f34518a4e9dd38bfb1d Mon Sep 17 00:00:00 2001
From: swachchhanda000 <swachchhandashrawan@gmail.com>
Date: Mon, 24 Mar 2025 10:42:23 +0545
Subject: [PATCH 2/8] metadata updated

---
 sysmonconfig-export-block.xml | 4 ++++
 sysmonconfig-export.xml       | 3 +++
 2 files changed, 7 insertions(+)

diff --git a/sysmonconfig-export-block.xml b/sysmonconfig-export-block.xml
index f7a481ed..83d06f6b 100644
--- a/sysmonconfig-export-block.xml
+++ b/sysmonconfig-export-block.xml
@@ -3,6 +3,7 @@
 	Source project:	https://github.com/SwiftOnSecurity/sysmon-config
 	Source license:	Creative Commons Attribution 4.0 | You may privatize, fork, edit, teach, publish, or deploy for commercial use - with attribution in the text.
 
+
 	WARNING: THIS CONFIG INCLUDES BLOCKING RULES THAT MAY CAUSE ISSUES ENDSYSTEMS!
 	         Test this configuration intensively before using it on productive systems
 
@@ -10,6 +11,9 @@
 
 	REQUIRED: Sysmon version 14 or higher (due to changes in syntax and bug-fixes)
 		https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon
+
+    Forked project:	https://github.com/Neo23x0/sysmon-config
+    Forked Last Updated: 2025-03-24
 -->
 
 <Sysmon schemaversion="4.90">
diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index a5453e1e..96f92529 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -4,6 +4,9 @@
 	Source project:	https://github.com/SwiftOnSecurity/sysmon-config
 	Source license:	Creative Commons Attribution 4.0 | You may privatize, fork, edit, teach, publish, or deploy for commercial use - with attribution in the text.
 
+    Forked project:	https://github.com/Neo23x0/sysmon-config
+    Forked Last Updated: 2025-03-24
+
 	REQUIRED: Sysmon version 13 or higher (due to changes in syntax and bug-fixes)
 		https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon
 

From 0ecd7626b7d0ef636012dbc2c1a1d680ec562a83 Mon Sep 17 00:00:00 2001
From: swachchhanda000 <swachchhandashrawan@gmail.com>
Date: Mon, 24 Mar 2025 10:54:47 +0545
Subject: [PATCH 3/8] fixed the indentation

---
 sysmonconfig-export-block.xml | 42 ++++++++++++++++----------------
 sysmonconfig-export.xml       | 46 +++++++++++++++++------------------
 2 files changed, 44 insertions(+), 44 deletions(-)

diff --git a/sysmonconfig-export-block.xml b/sysmonconfig-export-block.xml
index 83d06f6b..ac1fc406 100644
--- a/sysmonconfig-export-block.xml
+++ b/sysmonconfig-export-block.xml
@@ -971,7 +971,7 @@
 				<PipeName condition="begin with">\f53f</PipeName>
 				<PipeName condition="begin with">\rpc_</PipeName>
 				<PipeName condition="begin with">\spoolss_</PipeName>
-                <PipeName condition="begin with">\Winsock2\CatalogChangeListener</PipeName>
+				<PipeName condition="begin with">\Winsock2\CatalogChangeListener</PipeName>
 				<PipeName condition="begin with">\win_svc</PipeName>
 				<PipeName condition="begin with">\SearchTextHarvester</PipeName>
 				<PipeName condition="begin with">\adschemerpc</PipeName> <!-- Turla HyperStack - https://www.accenture.com/us-en/blogs/cyber-defense/turla-belugasturgeon-compromises-government-entity -->
@@ -981,12 +981,12 @@
 				<PipeName condition="begin with">\testPipe</PipeName> <!-- Emissary Panda Hyerbri - https://unit42.paloaltonetworks.com/emissary-panda-attacks-middle-east-government-sharepoint-servers/ -->
 				<PipeName condition="begin with">\demoagent_</PipeName>
                 <!--RMM Pipe-->
-                <PipeName condition="is">\adprinterpipe</PipeName>
+				<PipeName condition="is">\adprinterpipe</PipeName>
                 <!--Suspicious Location of Image-->
-                <Image condition="contains">:\PerfLogs\</Image>
-                <Image condition="contains">:\Users\Public\</Image>
-                <Image condition="contains">:\Windows\System32\Tasks\</Image>
-                <Image condition="contains">:\Windows\Tasks\</Image>
+				<Image condition="contains">:\PerfLogs\</Image>
+				<Image condition="contains">:\Users\Public\</Image>
+				<Image condition="contains">:\Windows\System32\Tasks\</Image>
+				<Image condition="contains">:\Windows\Tasks\</Image>
                 <!-- these are standard pipes that appear frequently but the Sigma rules use RE to match on malicious pipes that use the common names as a prefix -->
 				<PipeName condition="begin with">\scerpc</PipeName>
 				<PipeName condition="begin with">\ntsvcs</PipeName>
@@ -997,14 +997,14 @@
 				<Rule groupRelation="and"> <!-- Some interesting ConnectPipe events that we want to include -->
 					<EventType condition="is">ConnectPipe</EventType>
 					<PipeName condition="is">\MICROSOFT##WID\tsql\query</PipeName> <!-- https://github.com/SigmaHQ/sigma/pull/2128 -->
-                <PipeName condition="contains">\coerced\</PipeName> <!--https://blog.hackvens.fr/articles/CoercedPotato.html-->
-                <PipeName condition="contains">thisispipe</PipeName> <!-- DiagTrackEoP Default Named Pipe-->
-                <PipeName condition="contains">\pipe\</PipeName> <!--EfsPotato Named Pipe Creation-->
-                <PipeName condition="contains any">\imposecost;\imposingcost</PipeName> <!--Koh Default Named Pipe-->
-                <PipeName condition="begin with">\PAExec</PipeName> <!--PAExec default named pipe-->
-                <PipeName condition="contains">\RemCom</PipeName> <!--RemCom Default Named Pipe-->
-                <PipeName condition="contains">\PSEXESVC</PipeName> <!--PsExec Tool PipeName-->
-                <PipeName condition="contains">\PSEXECSVC</PipeName> <!--Implementation of PsExec in another form like python, CSharp etc-->
+				<PipeName condition="contains">\coerced\</PipeName> <!--https://blog.hackvens.fr/articles/CoercedPotato.html-->
+				<PipeName condition="contains">thisispipe</PipeName> <!-- DiagTrackEoP Default Named Pipe-->
+				<PipeName condition="contains">\pipe\</PipeName> <!--EfsPotato Named Pipe Creation-->
+				<PipeName condition="contains any">\imposecost;\imposingcost</PipeName> <!--Koh Default Named Pipe-->
+				<PipeName condition="begin with">\PAExec</PipeName> <!--PAExec default named pipe-->
+				<PipeName condition="contains">\RemCom</PipeName> <!--RemCom Default Named Pipe-->
+				<PipeName condition="contains">\PSEXESVC</PipeName> <!--PsExec Tool PipeName-->
+				<PipeName condition="contains">\PSEXECSVC</PipeName> <!--Implementation of PsExec in another form like python, CSharp etc-->
 				</Rule>
 			</PipeEvent>
 		</RuleGroup>
@@ -1015,14 +1015,14 @@
 				<PipeName condition="is">\scerpc</PipeName>
 				<PipeName condition="is">\ntsvcs</PipeName>
 				<PipeName condition="is">\wkssvc</PipeName>
-                <PipeName condition="is">\MsFteWds</PipeName>
-                <PipeName condition="is">\PGMessagePipe</PipeName>
-                <PipeName condition="is">\SearchTextHarvester</PipeName>
-                <PipeName condition="is">\spoolss</PipeName>
-                <PipeName condition="is">\srvsvc</PipeName>
+				<PipeName condition="is">\MsFteWds</PipeName>
+				<PipeName condition="is">\PGMessagePipe</PipeName>
+				<PipeName condition="is">\SearchTextHarvester</PipeName>
+				<PipeName condition="is">\spoolss</PipeName>
+				<PipeName condition="is">\srvsvc</PipeName>
                 <!--Aurora Default Pipe-->
-                <Image condition="end with">\aurora-agent-64.exe</Image>
-                <Image condition="end with">\aurora-agent.exe</Image>
+				<Image condition="end with">\aurora-agent-64.exe</Image>
+				<Image condition="end with">\aurora-agent.exe</Image>
 			</PipeEvent>
 		</RuleGroup>
 
diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index 96f92529..d8c69f0a 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -1014,7 +1014,7 @@
 				<PipeName condition="begin with">\f53f</PipeName>
 				<PipeName condition="begin with">\rpc_</PipeName>
 				<PipeName condition="begin with">\spoolss_</PipeName>
-                <PipeName condition="begin with">\Winsock2\CatalogChangeListener</PipeName>
+				<PipeName condition="begin with">\Winsock2\CatalogChangeListener</PipeName>
 				<PipeName condition="begin with">\win_svc</PipeName>
 				<PipeName condition="begin with">\SearchTextHarvester</PipeName>
 				<PipeName condition="begin with">\adschemerpc</PipeName> <!-- Turla HyperStack - https://www.accenture.com/us-en/blogs/cyber-defense/turla-belugasturgeon-compromises-government-entity -->
@@ -1022,15 +1022,15 @@
 				<PipeName condition="begin with">\bc367</PipeName> <!-- Pacifier - https://download.bitdefender.com/resources/files/News/CaseStudies/study/115/Bitdefender-Whitepaper-PAC-A4-en-EN1.pdf -->
 				<PipeName condition="begin with">\bc31a7</PipeName> <!-- Pacifier - https://download.bitdefender.com/resources/files/News/CaseStudies/study/115/Bitdefender-Whitepaper-PAC-A4-en-EN1.pdf -->
 				<PipeName condition="begin with">\testPipe</PipeName> <!-- Emissary Panda Hyerbri - https://unit42.paloaltonetworks.com/emissary-panda-attacks-middle-east-government-sharepoint-servers/ -->
-                <PipeName condition="begin with">\demoagent_</PipeName>
+				<PipeName condition="begin with">\demoagent_</PipeName>
                 <!--RMM Pipe-->
-                <PipeName condition="is">\adprinterpipe</PipeName>
+				<PipeName condition="is">\adprinterpipe</PipeName>
                 <!--Suspicious Location of Image-->
-                <Image condition="contains">:\PerfLogs\</Image>
-                <Image condition="contains">:\Users\Public\</Image>
-                <Image condition="contains">:\Windows\System32\Tasks\</Image>
-                <Image condition="contains">:\Windows\Tasks\</Image>
-                <Image condition="contains">\Microsoft\Windows\Start Menu\Programs\Startup\</Image>
+				<Image condition="contains">:\PerfLogs\</Image>
+				<Image condition="contains">:\Users\Public\</Image>
+				<Image condition="contains">:\Windows\System32\Tasks\</Image>
+				<Image condition="contains">:\Windows\Tasks\</Image>
+				<Image condition="contains">\Microsoft\Windows\Start Menu\Programs\Startup\</Image>
 				<!-- these are standard pipes that appear frequently but the Sigma rules use RE to match on malicious pipes that use the common names as a prefix -->
 				<PipeName condition="begin with">\scerpc</PipeName>
 				<PipeName condition="begin with">\ntsvcs</PipeName>
@@ -1042,14 +1042,14 @@
 					<EventType condition="is">ConnectPipe</EventType>
 					<PipeName condition="is">\MICROSOFT##WID\tsql\query</PipeName> <!-- https://github.com/SigmaHQ/sigma/pull/2128 -->
 				</Rule>
-                <PipeName condition="contains">\coerced\</PipeName> <!--https://blog.hackvens.fr/articles/CoercedPotato.html-->
-                <PipeName condition="contains">thisispipe</PipeName> <!-- DiagTrackEoP Default Named Pipe-->
-                <PipeName condition="contains">\pipe\</PipeName> <!--EfsPotato Named Pipe Creation-->
-                <PipeName condition="contains any">\imposecost;\imposingcost</PipeName> <!--Koh Default Named Pipe-->
-                <PipeName condition="begin with">\PAExec</PipeName> <!--PAExec default named pipe-->
-                <PipeName condition="contains">\RemCom</PipeName> <!--RemCom Default Named Pipe-->
-                <PipeName condition="contains">\PSEXESVC</PipeName> <!--PsExec Tool PipeName-->
-                <PipeName condition="contains">\PSEXECSVC</PipeName> <!--Implementation of PsExec in another form like python, CSharp etc-->
+				<PipeName condition="contains">\coerced\</PipeName> <!--https://blog.hackvens.fr/articles/CoercedPotato.html-->
+				<PipeName condition="contains">thisispipe</PipeName> <!-- DiagTrackEoP Default Named Pipe-->
+				<PipeName condition="contains">\pipe\</PipeName> <!--EfsPotato Named Pipe Creation-->
+				<PipeName condition="contains any">\imposecost;\imposingcost</PipeName> <!--Koh Default Named Pipe-->
+				<PipeName condition="begin with">\PAExec</PipeName> <!--PAExec default named pipe-->
+				<PipeName condition="contains">\RemCom</PipeName> <!--RemCom Default Named Pipe-->
+				<PipeName condition="contains">\PSEXESVC</PipeName> <!--PsExec Tool PipeName-->
+				<PipeName condition="contains">\PSEXECSVC</PipeName> <!--Implementation of PsExec in another form like python, CSharp etc-->
 			</PipeEvent>
 		</RuleGroup>
 		<!-- Common Pipe Names to would appear very often in -->
@@ -1059,14 +1059,14 @@
 				<PipeName condition="is">\scerpc</PipeName>
 				<PipeName condition="is">\ntsvcs</PipeName>
 				<PipeName condition="is">\wkssvc</PipeName>
-                <PipeName condition="is">\MsFteWds</PipeName>
-                <PipeName condition="is">\PGMessagePipe</PipeName>
-                <PipeName condition="is">\SearchTextHarvester</PipeName>
-                <PipeName condition="is">\spoolss</PipeName>
-                <PipeName condition="is">\srvsvc</PipeName>
+				<PipeName condition="is">\MsFteWds</PipeName>
+				<PipeName condition="is">\PGMessagePipe</PipeName>
+				<PipeName condition="is">\SearchTextHarvester</PipeName>
+				<PipeName condition="is">\spoolss</PipeName>
+				<PipeName condition="is">\srvsvc</PipeName>
                 <!--Aurora Default Pipe-->
-                <Image condition="end with">\aurora-agent-64.exe</Image>
-                <Image condition="end with">\aurora-agent.exe</Image>
+				<Image condition="end with">\aurora-agent-64.exe</Image>
+				<Image condition="end with">\aurora-agent.exe</Image>
 			</PipeEvent>
 		</RuleGroup>
 

From 10cf690465d216750670deacd00c7f57ce92b546 Mon Sep 17 00:00:00 2001
From: swachchhanda000 <swachchhandashrawan@gmail.com>
Date: Mon, 24 Mar 2025 10:56:20 +0545
Subject: [PATCH 4/8] fixed indentation - 2

---
 sysmonconfig-export-block.xml | 4 ++--
 sysmonconfig-export.xml       | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/sysmonconfig-export-block.xml b/sysmonconfig-export-block.xml
index ac1fc406..a20177aa 100644
--- a/sysmonconfig-export-block.xml
+++ b/sysmonconfig-export-block.xml
@@ -12,8 +12,8 @@
 	REQUIRED: Sysmon version 14 or higher (due to changes in syntax and bug-fixes)
 		https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon
 
-    Forked project:	https://github.com/Neo23x0/sysmon-config
-    Forked Last Updated: 2025-03-24
+	Forked project:	https://github.com/Neo23x0/sysmon-config
+	Forked Last Updated: 2025-03-24
 -->
 
 <Sysmon schemaversion="4.90">
diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index d8c69f0a..e7394f6c 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -4,8 +4,8 @@
 	Source project:	https://github.com/SwiftOnSecurity/sysmon-config
 	Source license:	Creative Commons Attribution 4.0 | You may privatize, fork, edit, teach, publish, or deploy for commercial use - with attribution in the text.
 
-    Forked project:	https://github.com/Neo23x0/sysmon-config
-    Forked Last Updated: 2025-03-24
+	Forked project:	https://github.com/Neo23x0/sysmon-config
+	Forked Last Updated: 2025-03-24
 
 	REQUIRED: Sysmon version 13 or higher (due to changes in syntax and bug-fixes)
 		https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon

From 7ad57da9187f52a9130470f7e426b66d6289d023 Mon Sep 17 00:00:00 2001
From: swachchhanda000 <swachchhandashrawan@gmail.com>
Date: Mon, 24 Mar 2025 10:57:45 +0545
Subject: [PATCH 5/8] typo issue

---
 sysmonconfig-export-block.xml | 2 +-
 sysmonconfig-export.xml       | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/sysmonconfig-export-block.xml b/sysmonconfig-export-block.xml
index a20177aa..5d45f363 100644
--- a/sysmonconfig-export-block.xml
+++ b/sysmonconfig-export-block.xml
@@ -13,7 +13,7 @@
 		https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon
 
 	Forked project:	https://github.com/Neo23x0/sysmon-config
-	Forked Last Updated: 2025-03-24
+	Fork Last Updated: 2025-03-24
 -->
 
 <Sysmon schemaversion="4.90">
diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index e7394f6c..05681e65 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -5,7 +5,7 @@
 	Source license:	Creative Commons Attribution 4.0 | You may privatize, fork, edit, teach, publish, or deploy for commercial use - with attribution in the text.
 
 	Forked project:	https://github.com/Neo23x0/sysmon-config
-	Forked Last Updated: 2025-03-24
+	Fork Last Updated: 2025-03-24
 
 	REQUIRED: Sysmon version 13 or higher (due to changes in syntax and bug-fixes)
 		https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon

From a5225b759cdd6472e75cbfb76b1f302a0b1cadad Mon Sep 17 00:00:00 2001
From: Swachchhanda Shrawan Poudel
 <87493836+swachchhanda000@users.noreply.github.com>
Date: Wed, 2 Jul 2025 16:49:34 +0545
Subject: [PATCH 6/8] Apply suggestions from code review

Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com>
---
 sysmonconfig-export-block.xml | 4 ----
 sysmonconfig-export.xml       | 3 ---
 2 files changed, 7 deletions(-)

diff --git a/sysmonconfig-export-block.xml b/sysmonconfig-export-block.xml
index 5d45f363..0bf43bf9 100644
--- a/sysmonconfig-export-block.xml
+++ b/sysmonconfig-export-block.xml
@@ -3,7 +3,6 @@
 	Source project:	https://github.com/SwiftOnSecurity/sysmon-config
 	Source license:	Creative Commons Attribution 4.0 | You may privatize, fork, edit, teach, publish, or deploy for commercial use - with attribution in the text.
 
-
 	WARNING: THIS CONFIG INCLUDES BLOCKING RULES THAT MAY CAUSE ISSUES ENDSYSTEMS!
 	         Test this configuration intensively before using it on productive systems
 
@@ -11,9 +10,6 @@
 
 	REQUIRED: Sysmon version 14 or higher (due to changes in syntax and bug-fixes)
 		https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon
-
-	Forked project:	https://github.com/Neo23x0/sysmon-config
-	Fork Last Updated: 2025-03-24
 -->
 
 <Sysmon schemaversion="4.90">
diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index 05681e65..d8e517c3 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -4,9 +4,6 @@
 	Source project:	https://github.com/SwiftOnSecurity/sysmon-config
 	Source license:	Creative Commons Attribution 4.0 | You may privatize, fork, edit, teach, publish, or deploy for commercial use - with attribution in the text.
 
-	Forked project:	https://github.com/Neo23x0/sysmon-config
-	Fork Last Updated: 2025-03-24
-
 	REQUIRED: Sysmon version 13 or higher (due to changes in syntax and bug-fixes)
 		https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon
 

From c0039102d035cdf24420004e075218d1afeb3f47 Mon Sep 17 00:00:00 2001
From: Swachchhanda Shrawan Poudel
 <87493836+swachchhanda000@users.noreply.github.com>
Date: Wed, 2 Jul 2025 17:18:54 +0545
Subject: [PATCH 7/8] Apply suggestions from code review

Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com>
---
 sysmonconfig-export-block.xml | 1 -
 sysmonconfig-export.xml       | 1 -
 2 files changed, 2 deletions(-)

diff --git a/sysmonconfig-export-block.xml b/sysmonconfig-export-block.xml
index 0bf43bf9..84efe15a 100644
--- a/sysmonconfig-export-block.xml
+++ b/sysmonconfig-export-block.xml
@@ -975,7 +975,6 @@
 				<PipeName condition="begin with">\bc367</PipeName> <!-- Pacifier - https://download.bitdefender.com/resources/files/News/CaseStudies/study/115/Bitdefender-Whitepaper-PAC-A4-en-EN1.pdf -->
 				<PipeName condition="begin with">\bc31a7</PipeName> <!-- Pacifier - https://download.bitdefender.com/resources/files/News/CaseStudies/study/115/Bitdefender-Whitepaper-PAC-A4-en-EN1.pdf -->
 				<PipeName condition="begin with">\testPipe</PipeName> <!-- Emissary Panda Hyerbri - https://unit42.paloaltonetworks.com/emissary-panda-attacks-middle-east-government-sharepoint-servers/ -->
-				<PipeName condition="begin with">\demoagent_</PipeName>
                 <!--RMM Pipe-->
 				<PipeName condition="is">\adprinterpipe</PipeName>
                 <!--Suspicious Location of Image-->
diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index d8e517c3..73610206 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -1019,7 +1019,6 @@
 				<PipeName condition="begin with">\bc367</PipeName> <!-- Pacifier - https://download.bitdefender.com/resources/files/News/CaseStudies/study/115/Bitdefender-Whitepaper-PAC-A4-en-EN1.pdf -->
 				<PipeName condition="begin with">\bc31a7</PipeName> <!-- Pacifier - https://download.bitdefender.com/resources/files/News/CaseStudies/study/115/Bitdefender-Whitepaper-PAC-A4-en-EN1.pdf -->
 				<PipeName condition="begin with">\testPipe</PipeName> <!-- Emissary Panda Hyerbri - https://unit42.paloaltonetworks.com/emissary-panda-attacks-middle-east-government-sharepoint-servers/ -->
-				<PipeName condition="begin with">\demoagent_</PipeName>
                 <!--RMM Pipe-->
 				<PipeName condition="is">\adprinterpipe</PipeName>
                 <!--Suspicious Location of Image-->

From 026883f36b5ec1cd705faa1823c315c12604cbb6 Mon Sep 17 00:00:00 2001
From: Swachchhanda Shrawan Poudel
 <87493836+swachchhanda000@users.noreply.github.com>
Date: Wed, 2 Jul 2025 17:20:09 +0545
Subject: [PATCH 8/8] Update sysmonconfig-export-block.xml

---
 sysmonconfig-export-block.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sysmonconfig-export-block.xml b/sysmonconfig-export-block.xml
index 84efe15a..9f4489cf 100644
--- a/sysmonconfig-export-block.xml
+++ b/sysmonconfig-export-block.xml
@@ -992,6 +992,7 @@
 				<Rule groupRelation="and"> <!-- Some interesting ConnectPipe events that we want to include -->
 					<EventType condition="is">ConnectPipe</EventType>
 					<PipeName condition="is">\MICROSOFT##WID\tsql\query</PipeName> <!-- https://github.com/SigmaHQ/sigma/pull/2128 -->
+				</Rule>
 				<PipeName condition="contains">\coerced\</PipeName> <!--https://blog.hackvens.fr/articles/CoercedPotato.html-->
 				<PipeName condition="contains">thisispipe</PipeName> <!-- DiagTrackEoP Default Named Pipe-->
 				<PipeName condition="contains">\pipe\</PipeName> <!--EfsPotato Named Pipe Creation-->
@@ -1000,7 +1001,6 @@
 				<PipeName condition="contains">\RemCom</PipeName> <!--RemCom Default Named Pipe-->
 				<PipeName condition="contains">\PSEXESVC</PipeName> <!--PsExec Tool PipeName-->
 				<PipeName condition="contains">\PSEXECSVC</PipeName> <!--Implementation of PsExec in another form like python, CSharp etc-->
-				</Rule>
 			</PipeEvent>
 		</RuleGroup>
 		<!-- Common Pipe Names to would appear very often in -->