Named pipes let processes communicate through named endpoints. This page groups rules that select pipe events, pipe names, process images, IPC$ access checks, lookup results, or commands that name pipes.
- Sysmon Event ID 17: PipeEvent (Pipe Created)
- Sysmon Event ID 18: PipeEvent (Pipe Connected)
- Security Event ID 5145: A network share object was checked to see whether client access was desired
Pipe Events with Name or Process Predicates #
Rules select pipe event records using names, name patterns, or process context.
- ADFS Database Named Pipe Connection By Uncommon Tool Sigma
Detects suspicious local connections via a named pipe to the AD FS configuration database (Windows Internal Database). Used to access information such as the AD FS configuration settings which contains sensitive information used to sign SAML tokens.
- Alternate PowerShell Hosts Pipe Sigma
Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe
- CobaltStrike Named Pipe Sigma
Detects the creation of a named pipe as used by CobaltStrike
- CobaltStrike Named Pipe Patterns Sigma
Detects the creation of a named pipe with a pattern found in CobaltStrike malleable C2 profiles
- Malicious Named Pipe Created Sigma
Detects the creation of a named pipe seen used by known APTs or malware.
- New PowerShell Instance Created Sigma
Detects the execution of PowerShell via the creation of a named pipe starting with PSHost
- PsExec Default Named Pipe Sigma
Detects PsExec service default pipe creation
- PsExec Tool Execution From Suspicious Locations - PipeName Sigma
Detects PsExec default pipe creation where the image executed is located in a suspicious location. Which could indicate that the tool is being used in an attack
- PUA - PAExec Default Named Pipe Sigma
Detects PAExec default named pipe
- RedSun - Named Pipe Created Sigma
Detects the creation of a named pipe with the hardcoded name "REDSUN". The RedSun exploit tool uses a pipe with this name for synchronisation and command communication between its components during the Cloud Files API + oplock-based AV bypass and privilege escalation chain. RedSun creates the pipe as \\??\pipe\REDSUN. The pipe server listens for the token-duplicated elevated process to connect and respond, completing the privilege escalation from user to SYSTEM. Presence of this pipe name indicates active or recent RedSun execution.
- Turla Group Named Pipes Sigma
Detects a named pipe used by Turla group samples
Pipe Indicators Resolved Through Lookups #
Rules resolve selected pipe names through indicator lookups.
No rules currently have sufficient source evidence for selection in this section.
IPC$ Access Checks #
Security Event ID 5145 records access checks for named pipe targets under IPC$, including atsvc, svcctl, and spoolss.
No rules currently have sufficient source evidence for selection in this section.
Command and Script References to Pipes #
Rules select pipe paths in process commands or inspected script content.
No rules currently have sufficient source evidence for selection in this section.