Linux Named Pipe Creation via mkfifo Process Execution

What it detects

This rule identifies process executions where the command image ends with '/mkfifo', indicating creation of a new named pipe (FIFO). Named pipes can be used to coordinate inter-process communication and may also support attacker workflows for staging or command exchange. Detection relies on Linux process creation telemetry, specifically the executable path ending in mkfifo.

Reporting behind it

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-named-pipe-creation-via-mkfifo-utility-9d779ce8

title: Linux Named Pipe Creation via mkfifo Process Execution
id: 90bfe3bb-d09e-4da1-8931-4e39f528f5c8
status: test
description: This rule identifies process executions where the command image ends with '/mkfifo', indicating creation of a new named pipe (FIFO). Named pipes can be used to coordinate inter-process communication and may also support attacker workflows for staging or command exchange. Detection relies on Linux process creation telemetry, specifically the executable path ending in mkfifo.
references:
  - https://dev.to/0xbf/use-mkfifo-to-create-named-pipe-linux-tips-5bbk
  - https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_mkfifo_named_pipe_creation.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-06-16
tags:
  - attack.execution
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith: /mkfifo
  condition: selection
falsepositives:
  - Unknown
level: low
license: DRL-1.1
related:
  - id: 9d779ce8-5256-4b13-8b6f-b91c602b43f4
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL