SUSP_Echo_Pipe_Pattern_Jun26

Rule Info

Name
SUSP_Echo_Pipe_Pattern_Jun26
Author
Florian Roth
Description
Detects suspicious command line patterns involving echo and named pipes, often used by Cobalt Strike and other tools for fileless payload delivery
Score
70
Date
2026-06-15
Minimum Yara
3.5.0
Rule Hash
50ce8ccb4cf9e3a3d48fd695c0479c6b
Tags
['COBALTSTRIKE', 'T1550_002', 'SUSP']
Required Modules
[]

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
20
Suspicious (< 10 engines)
24
Clean (0 engines)
10

Rule Matches

Timestamp
Positives
Total
Hash
VT
2026-11-03 08:06:09
2
72
8eab76aa6c3251258a6c5291d863ee8b359935a3cb43620bfcd5c6bb394add2a
2026-11-03 06:43:01
3
72
aaff3547c8320128192418f6a3eac0a0f29df29e9d0b2d2713473e6ed475e88a
2026-11-03 05:30:59
0
72
d792e540d27a714853350a7639d4b1828d9ff494677624d18f956173b8476e09
2026-11-03 04:30:37
0
72
23b45a6a31701df7bbe5acb56a00d87ef8af129c2016663cde74299b58b9c9ce
2026-11-02 23:05:30
0
71
464f6b3cac530f1ab5afdfa2bb7d2202bbb5abc62044e8398637678f56de5d1e
2026-11-02 23:04:29
1
72
2c17a76de3f69b53fa34c2ba022eddf7babd0731d76d3676ad5b7c729fa14e16
2026-11-02 22:55:19
1
71
9e3b896b896964bfb78cf17256486ae3437c092dce1ff0c7afd48af3d8631c3c
2026-11-02 18:00:40
0
70
419d056ec10065c78a4db653f523a0871fe2215040d3c4b65f499365f323b89d
2026-11-02 07:39:28
4
65
485deb05fad9b0d337e728bd135b6d55821775b861c1d3c0de892fa2eef6a730
2026-11-01 23:45:37
0
72
5da427243a4eafb21834ab423357ca86b75500703f845a2e29d8870270019494
2026-10-29 23:52:37
3
65
3ba3de352fb2ac8fca5be6ca0d864ec2dbc91a7c009c87c4a80b7a373c1829ca
2026-10-29 23:42:28
3
72
67c0805f3bac59babe61b6fc6477488ffbc7df5afeb1698be9399efd76a76a56
2026-10-27 17:04:21
1
72
bc8b392b4b8132e075b8632e2c9852be2da9b0e1a7f12c16df802616e2b0378d
2026-10-27 17:02:47
1
70
b8699665e3c9b72a462dd41b9aaa1a58d0d2b72f8d6b285987b41930eea93749
2026-10-27 16:59:15
0
72
c31abb2b227f60de012c11f619455579555b484eed57d81a1306c587e1372478
2026-10-27 16:59:07
1
72
a53af969151b95248819ff727a3a5a810361f9674fb12d141b3e751e3ffc71ea
2026-10-27 16:58:56
0
72
9f54d3886a726b72e6465a694d682e2644362d4b7bbe0ac3ebaa47d4d93d821a
2026-10-20 19:25:26
0
63
541e1d3c0334c0088373434beaa32f2aec6c6d5d11f7abd9b0fcca1eda3e6bfe
2026-10-02 20:52:18
22
72
f666aed72461a80b4403351c9370e0901056514f0a8d4e82f2090bd65d78604c
2026-10-02 05:29:12
20
62
15542478c973397350b830310d79c50cc9d722bb4e92805addbeebb61f800707
2026-09-25 00:03:46
20
71
d058cfa434de93eff4c355d2ba0447b919a57b61bc1de5dfe244097c7112b4eb
2026-09-18 05:21:16
0
62
477641e07c4fc49c0e156c8b8dfc7d7357695d03a7ccdda95d6c91a65604e4ca
2026-09-16 20:19:48
6
53
762055d5ac8698f15b4e428e778599ddc1844c2fd16dfe9088c82b851cb0e968
2026-09-16 20:10:41
11
68
7a425d47a13c1ec87dfc4bb6fb1642698675bfaa41991dd7ac3f7454e76d817b
2026-09-13 14:39:45
3
72
c3386e0dfa1dec861011c4653adf5836534171937449417038807e59b728f3f2
2026-09-12 14:21:17
2
72
447051011e6a42a46ac9f7f24bd3172af9662e62c9ae200a7a953433dbbfd06e
2026-09-09 14:55:48
0
61
fbfcab8e0c4f572341c9c5c5773170397557d981252381225361714cbff170e9
2026-08-26 00:29:16
4
71
92acb669895ffafffb44148573f16aa90df2181bad30cecaa7a962246783b6e0
2026-08-17 09:09:37
15
60
c7e93ef45c576506a659062d4daa127a791a3df50e2d80c2b73fc2e356ce705f
2026-08-09 05:31:46
2
68
93c68c17c2dd19dde9861624a15f33d713805723865928cc695dce80bf82b370
2026-08-07 22:01:24
44
71
2df3db9496859ac791118a30153efc27e991fd6bec8bad8afa3c79b1d0532f97
2026-08-05 23:54:17
14
70
5d47d04faf51df41225c49c7568c4128195b18f2a9cd0f6715fcb95f919a1611
2026-08-03 22:56:29
10
71
99c9373a54802f746c85dd52d638b706fa0b8f29cf7164e7043574b113b4c3dc
2026-07-29 19:48:17
2
68
c150884242a1719a1a77887da04add9daf3a977da7b88f0d6bc9e516a23f9c39
2026-07-28 09:40:44
4
65
d10499be4e5d32b24468a4fcccffde9f224a7874cb4f05a083af46599e5f41e1
2026-07-25 07:06:01
2
67
b9a95215fca89deff11c10b019597a11af38428730934d3f8eeddf684458acd5
2026-07-24 19:01:28
24
61
84a086d6d4afc2a0de2040518757ee99eb83550156b95719c936a16130c7e9fb
2026-07-24 13:53:07
6
61
e1bb83d4583aaee2144f37afd8ce9b647ae7f34a636b85ce4a75683fba93f30e
2026-07-21 17:39:14
24
70
79d682fd5ffa40eb8c77e7aa342fb2b5b2d242def7007b75677194f303dedd03
2026-07-19 17:02:19
5
61
9220b0725221244a6b61dff8dabbf382831c0fcc2ad9d261ae60cb1f2b082fff
2026-07-17 20:31:18
10
70
f70030e9ccee15fbaafc2591c9e62fa9363450cfdfb063e295980ed001abf21a
2026-07-17 18:28:34
18
70
347280e445fadca4811589ad168e599191a7678c1a07f3a1e2265db65ee29f7f
2026-07-17 18:06:22
18
69
942371c4457d97e8fde3d5a40cec434882069872894ddedd508a038081fd4193
2026-07-17 15:22:17
22
69
5c82694a81273836d47d9c445ba084e60a9086e793b14f6f555c0f4037eb9c2e
2026-07-16 15:40:27
35
70
7457c2a142af677e21582853a72ce80d5d4acad3be8a73a4bda443d966abb39d
2026-07-14 23:33:09
31
70
399281b6ddcdcd18c3c7223c135cd50a7a0c0d611828499aaca106b66056606b
2026-07-14 16:20:39
19
70
820bc4c6266754b946d3468aac1e9c6e70a596a7f7530af790324da58cbde45d
2026-07-14 14:08:59
17
70
a8254c3e697e70414087d6e27ced67ffb171ca5e4f3532722d1aa2c7140a212f
2026-07-13 12:01:27
2
48
3865761b5327ffdc349ede9f57a6b4ee0ebc5278ad3d7fd4fffa75fd06f379da
2026-07-10 02:11:59
46
70
21dc5548dba2f59bedd7ad55d2c9c5eac4a0edd0829a39dcc30f6b2b06c53b24
2026-07-09 21:30:57
19
61
cac38c40a0420f2d1c71f6dd13143edab1ead77b9bb4cf6e9cea34c9f3bcf3da
2026-07-08 14:08:35
1
40
5e1d7c4a2e2e3eea4551b5f7a15f248b04d7b9ddd475858c21baaf26cfa624a6
2026-07-06 12:20:47
5
70
bfb081ff18a8d9f552820bb9aa26bff1bcc6950a47efb7cff042ab466634e5c7
2026-07-06 12:20:17
4
70
f8177adac7166f25654c18a14de844b10bb9bcefe2bf1ed8a4de26ec96b8ebbb

Rule Matches per Month (last 24 months)