Windows Named Pipe Creation: PAExec Default Pipe (\PAExec*)
Alerts on named pipe creations starting with "\PAExec" associated with PAExec default behavior on Windows.
- Product
- windows
- Category
- pipe_created
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-10-26
- Updated
- 2026-07-31
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies creation of Windows named pipes whose name starts with \PAExec, matching PAExec’s default pipe naming behavior. Attackers can use named pipes for local or remote execution and command execution, making pipe creation telemetry a useful signal for suspicious tooling. It relies on named pipe creation events (e.g., Sysmon pipe events) that include the PipeName field.
Reporting behind it
- github.comhttps://github.com/microsoft/Microsoft-365-Defender-Hunting-Queries/blob/efa17a600b43c897b4b7463cc8541daa1987eeb4/Command%20and%20Control/C2-NamedPipe.md
- github.comhttps://github.com/poweradminllc/PAExec
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/pipe_created/pipe_created_pua_paexec_default_pipe.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Named Pipe Creation: PAExec Default Pipe (\\PAExec*)"
id: fd3b2b18-0fc4-44ed-9541-120af0211106
status: test
description: This rule identifies creation of Windows named pipes whose name starts with \PAExec, matching PAExec’s default pipe naming behavior. Attackers can use named pipes for local or remote execution and command execution, making pipe creation telemetry a useful signal for suspicious tooling. It relies on named pipe creation events (e.g., Sysmon pipe events) that include the PipeName field.
references:
- https://github.com/microsoft/Microsoft-365-Defender-Hunting-Queries/blob/efa17a600b43c897b4b7463cc8541daa1987eeb4/Command%20and%20Control/C2-NamedPipe.md
- https://github.com/poweradminllc/PAExec
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/pipe_created/pipe_created_pua_paexec_default_pipe.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-10-26
tags:
- attack.execution
- attack.t1569.002
logsource:
category: pipe_created
product: windows
definition: Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575
detection:
selection:
PipeName|startswith: \PAExec
condition: selection
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: f6451de4-df0a-41fa-8d72-b39f54a08db5
type: derived