huntrule

Suspicious Salamander Named Pipe Creation

PremiumReviewedSigma · High · v1
Product
windows
Category
pipe_created
Author
HuntRule
Published
2026-09-23
Updated
2026-09-23
AnalysisDetection

ATT&CK techniques

Priv Esc → Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects creation of a named pipe called salamander_pipe, an inter-process communication channel used by GhostRedirector tooling including Potato-family privilege escalation utilities. This specific pipe name is not associated with legitimate software and indicates the presence of the group's backdoor or local privilege escalation components.

Reporting behind it

Related detections9 linkedT1055 — drag to rearrange
Suspicious DynamicWrapperX dynwrapx.dll Load Enabling Script Based Injection
Suspicious Image File Execution Options Debugger Hijack
Suspicious DllHost Spawned By MMC Without Arguments via PASTALOADER
Suspicious vbc.exe Spawned by Installer Process
Suspicious Office Application Spawning Script Or Shell Interpreter
Suspicious Network Connection From wabmig.exe (Turian Injection)
Suspicious Outbound Network Connection from Explorer Process
Suspicious AppLaunch.exe Spawned As Injection Target (via process_creation)
Suspicious BugSleep Marker File in Public Directory
Suspicious Salamander Named Pipe Creation
Pivot detection · T1055 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.