Windows Named Pipe Creation: PAExec Default Pipe (\PAExec*)

ATT&CK techniques

Execution

Recon
Resource Dev
Initial Access
Execution
- T1569.002Service Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies creation of Windows named pipes whose name starts with \PAExec, matching PAExec’s default pipe naming behavior. Attackers can use named pipes for local or remote execution and command execution, making pipe creation telemetry a useful signal for suspicious tooling. It relies on named pipe creation events (e.g., Sysmon pipe events) that include the PipeName field.

Reporting behind it

Related detections9 linkedT1569.002 — drag to rearrange

PsExec Remote Service Execution on Target Host (via process_creation)

Renamed Procdump Tool Used for Dumping LSASS Process (via process_creation)

Suspicious Service Installation Masquerading as winupd

Suspicious PSexec Application Execution (via process_creation)

Malicious Metasploit PsExec Named Pipe Command Execution

Malicious PsExec Service Installation via PSEXESVC

Malicious NotPetya Payload Execution via Rundll32 Ordinal Export from Windows Directory

Suspicious Lateral Movement via PsExec Service (via process_creation)

Possible PsExec Remote Service Installation with Randomly Named Service (via security)

Windows Named Pipe Creation: PAExec Default Pipe (\PAExec*)

Pivot detection · T1569.002 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-detect-paexec-default-named-pipe-creation-via-sysmon-f6451de4

title: "Windows Named Pipe Creation: PAExec Default Pipe (\\PAExec*)"
id: fd3b2b18-0fc4-44ed-9541-120af0211106
status: test
description: This rule identifies creation of Windows named pipes whose name starts with \PAExec, matching PAExec’s default pipe naming behavior. Attackers can use named pipes for local or remote execution and command execution, making pipe creation telemetry a useful signal for suspicious tooling. It relies on named pipe creation events (e.g., Sysmon pipe events) that include the PipeName field.
references:
  - https://github.com/microsoft/Microsoft-365-Defender-Hunting-Queries/blob/efa17a600b43c897b4b7463cc8541daa1987eeb4/Command%20and%20Control/C2-NamedPipe.md
  - https://github.com/poweradminllc/PAExec
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/pipe_created/pipe_created_pua_paexec_default_pipe.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-10-26
tags:
  - attack.execution
  - attack.t1569.002
logsource:
  category: pipe_created
  product: windows
  definition: Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575
detection:
  selection:
    PipeName|startswith: \PAExec
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: f6451de4-df0a-41fa-8d72-b39f54a08db5
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL