Linux Named Pipe Creation via mkfifo Utility

Flags Linux process executions of /mkfifo that create named pipes.

FreeUnreviewedSigmalowv1

linux-named-pipe-creation-via-mkfifo-utility-9d779ce8

title: Linux Named Pipe Creation via mkfifo Utility
id: 90bfe3bb-d09e-4da1-8931-4e39f528f5c8
status: test
description: This rule identifies when the mkfifo utility is used to create a named pipe on Linux systems. Named pipes can be leveraged by attackers to coordinate inter-process communication, set up data flows, or stage behaviors that rely on filesystem-based IPC. The detection relies on process creation telemetry and matches the executed image path ending with /mkfifo.
references:
  - https://dev.to/0xbf/use-mkfifo-to-create-named-pipe-linux-tips-5bbk
  - https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_mkfifo_named_pipe_creation.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-06-16
tags:
  - attack.execution
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith: /mkfifo
  condition: selection
falsepositives:
  - Unknown
level: low
license: DRL-1.1
related:
  - id: 9d779ce8-5256-4b13-8b6f-b91c602b43f4
    type: derived

What it detects

This rule identifies when the mkfifo utility is used to create a named pipe on Linux systems. Named pipes can be leveraged by attackers to coordinate inter-process communication, set up data flows, or stage behaviors that rely on filesystem-based IPC. The detection relies on process creation telemetry and matches the executed image path ending with /mkfifo.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.