huntrule

Suspicious Named Pipe Creation via Command Echo

PremiumReviewedSigma · Medium · v1
Product
windows
Category
process_creation
Author
HuntRule
Published
2026-09-28
Updated
2026-09-28
AnalysisDetection

ATT&CK techniques

Execution

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects a command shell echoing data into a named pipe device path, a covert local inter-process channel used by an APT targeting Vietnamese human rights defenders for command output relay. Writing to the pipe device path from cmd is atypical of normal administrative activity. Named pipe abuse supports stealthy internal command and control and privilege operations.

Reporting behind it

Related detections9 linkedT1059.003 — drag to rearrange
Suspicious Command Shell Spawned by MSSQL Server Process
Exchange Worker Process Spawning Command Shell via OWASSRF
Suspicious Command Execution via ComSpec Environment Variable Obfuscation
Suspicious File Concatenation via copy Binary Mode
Suspicious Hidden PowerShell Launched by Batch Script
Suspicious Command Shell Executing Batch Script from LNK Delivery
Suspicious Office Application Spawning Script Interpreter Chain
Malicious RoKRAT Staged Loader Files in Temp via LNK (via file_event)
Malicious Command Execution Spawned by SharePoint w3wp Worker Process
Suspicious Named Pipe Creation via Command Echo
Pivot detection · T1059.003 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.