Linux Named Pipe Creation via mkfifo in /tmp
Flags mkfifo executions that create named pipes in /tmp, a commonly abused location.
FreeReviewedSigma · Medium · v2
- Product
- linux
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-06-16
- Updated
- 2026-07-31
What it detects
Flags process executions where the binary path ends with /mkfifo and the command line includes /tmp/, indicating creation of a new named pipe in a potentially risky location. Attackers may use named pipes for staging or inter-process communication when hiding artifacts under commonly writable directories. Detection relies on Linux process creation telemetry capturing the executed image path and the command line.
Reporting behind it
- dev.tohttps://dev.to/0xbf/use-mkfifo-to-create-named-pipe-linux-tips-5bbk
- mandiant.comhttps://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_mkfifo_named_pipe_creation_susp_location.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
linux-named-pipe-creation-via-mkfifo-from-tmp-999c3b12
title: Linux Named Pipe Creation via mkfifo in /tmp
id: 0ddbc0b5-18f0-40e8-a7f4-d7f0e20dbf80
related:
- id: 9d779ce8-5256-4b13-8b6f-b91c602b43f4
type: derived
- id: 999c3b12-0a8c-40b6-8e13-dd7d62b75c7a
type: derived
status: test
description: Flags process executions where the binary path ends with /mkfifo and the command line includes /tmp/, indicating creation of a new named pipe in a potentially risky location. Attackers may use named pipes for staging or inter-process communication when hiding artifacts under commonly writable directories. Detection relies on Linux process creation telemetry capturing the executed image path and the command line.
references:
- https://dev.to/0xbf/use-mkfifo-to-create-named-pipe-linux-tips-5bbk
- https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_mkfifo_named_pipe_creation_susp_location.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-06-16
tags:
- attack.execution
logsource:
category: process_creation
product: linux
detection:
selection:
Image|endswith: /mkfifo
CommandLine|contains: " /tmp/"
condition: selection
falsepositives:
- Unknown
level: medium
license: DRL-1.1