Linux Named Pipe Creation via mkfifo Process Execution
Flags Linux process executions of /mkfifo that create named pipes.
FreeReviewedSigma · Low · v2
- Product
- linux
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-06-16
- Updated
- 2026-07-31
What it detects
This rule identifies process executions where the command image ends with '/mkfifo', indicating creation of a new named pipe (FIFO). Named pipes can be used to coordinate inter-process communication and may also support attacker workflows for staging or command exchange. Detection relies on Linux process creation telemetry, specifically the executable path ending in mkfifo.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
linux-named-pipe-creation-via-mkfifo-utility-9d779ce8
title: Linux Named Pipe Creation via mkfifo Process Execution
id: 90bfe3bb-d09e-4da1-8931-4e39f528f5c8
status: test
description: This rule identifies process executions where the command image ends with '/mkfifo', indicating creation of a new named pipe (FIFO). Named pipes can be used to coordinate inter-process communication and may also support attacker workflows for staging or command exchange. Detection relies on Linux process creation telemetry, specifically the executable path ending in mkfifo.
references:
- https://dev.to/0xbf/use-mkfifo-to-create-named-pipe-linux-tips-5bbk
- https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_mkfifo_named_pipe_creation.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-06-16
tags:
- attack.execution
logsource:
category: process_creation
product: linux
detection:
selection:
Image|endswith: /mkfifo
condition: selection
falsepositives:
- Unknown
level: low
license: DRL-1.1
related:
- id: 9d779ce8-5256-4b13-8b6f-b91c602b43f4
type: derived