Linux Named Pipe Creation via mkfifo from /tmp

Flags mkfifo executions that create named pipes in /tmp, a commonly abused location.

FreeUnreviewedSigmamediumv1

linux-named-pipe-creation-via-mkfifo-from-tmp-999c3b12

title: Linux Named Pipe Creation via mkfifo from /tmp
id: 0ddbc0b5-18f0-40e8-a7f4-d7f0e20dbf80
related:
  - id: 9d779ce8-5256-4b13-8b6f-b91c602b43f4
    type: derived
  - id: 999c3b12-0a8c-40b6-8e13-dd7d62b75c7a
    type: derived
status: test
description: This rule identifies process executions that invoke mkfifo to create a named pipe in a potentially suspicious context, specifically when the command line includes /tmp/. Attackers may use named pipes for inter-process communication, staging, or stealthy data transfer during exploitation or post-exploitation activity. It relies on Linux process creation telemetry capturing the executed image path and the command line.
references:
  - https://dev.to/0xbf/use-mkfifo-to-create-named-pipe-linux-tips-5bbk
  - https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_mkfifo_named_pipe_creation_susp_location.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-06-16
tags:
  - attack.execution
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith: /mkfifo
    CommandLine|contains: " /tmp/"
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1

What it detects

This rule identifies process executions that invoke mkfifo to create a named pipe in a potentially suspicious context, specifically when the command line includes /tmp/. Attackers may use named pipes for inter-process communication, staging, or stealthy data transfer during exploitation or post-exploitation activity. It relies on Linux process creation telemetry capturing the executed image path and the command line.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.