ConnectPipe for \MICROSOFT##WID\tsql\query

Author: Neo23x0

sysmonconfig-export.xml

@@ -960,7 +960,7 @@
 					<PipeName condition="begin with">\Winsock2\CatalogChangeListener-</PipeName>
 					<PipeName condition="end with">-0,</PipeName>
 				</Rule>
-				<!-- these are standard pipes that appear frequently but the Sigma rules use RE to match exactly -->
+				<!-- these are standard pipes that appear frequently but the Sigma rules use RE to match on malicious pipes that use the common names as a prefix -->
 				<PipeName condition="begin with">\scerpc</PipeName>
 				<PipeName condition="begin with">\ntsvcs</PipeName>
 				<PipeName condition="begin with">\wkssvc</PipeName>
@@ -969,16 +969,23 @@
 				<Image condition="end with">\scrcons.exe</Image> <!-- Susupicious WMI Event Consumer creating a named pipe -->
 			</PipeEvent>
 		</RuleGroup>
-		<!-- we skip the connect pipe event since they could be to noisy and a CreatePipe event should come before these -->
-		<RuleGroup name="" groupRelation="or">
+		<!-- Common Pipe Names to would appear very often in -->
+		<RuleGroup name="CommonPipes" groupRelation="or">
 			<PipeEvent onmatch="exclude">
-				<EventType condition="is">ConnectPipe</EventType>
-				<!-- the standard named pipes used by Windows services (we want only the ones that begin with these names)-->
+				<!-- the standard named pipes used by Windows services (we want only the ones that begin with these names) -->
 				<PipeName condition="is">\scerpc</PipeName>
 				<PipeName condition="is">\ntsvcs</PipeName>
 				<PipeName condition="is">\wkssvc</PipeName>
 			</PipeEvent>
 		</RuleGroup>
+		<!-- ConnectPipe Events -->
+		<!-- Some interesting ConnectPipe events that we want to include -->
+		<RuleGroup name="InterestingConnectPipe" groupRelation="and">
+			<PipeEvent onmatch="include">
+				<EventType condition="is">ConnectPipe</EventType>
+				<PipeName condition="is">\MICROSOFT##WID\tsql\query</PipeName> <!-- https://github.com/SigmaHQ/sigma/pull/2128 -->
+			</PipeEvent>
+		</RuleGroup>
 
 	<!--SYSMON EVENT ID 19 & 20 & 21 : WMI EVENT MONITORING [WmiEvent]-->
 		<!--EVENT 19: "WmiEventFilter activity detected"-->