huntrule

Windows Named Pipe Creation: Default RemCom Pipe Name

Alerts on creation of named pipes with names containing "\RemCom" on Windows.

FreeReviewedSigma · Medium · v2
Product
windows
Category
pipe_created
Author
Nikita Nazarov, oscd.community, Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2023-08-07
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Execution → Lateral Movement

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Windows systems where a named pipe is created with a pipe name containing '\RemCom', matching the default RemCom pipe naming. Such named pipes are commonly used for inter-process communication that can support lateral movement or remote task execution via covert channels. The detection relies on telemetry that logs named pipe creation events, including the pipe name field.

Reporting behind it

Related detections9 linkedT1021.002 — drag to rearrange
Suspicious RemCom Service Named Pipe for Lateral Movement (via pipe_created)
Malicious PsExec Service Binary Execution from Windows Directory via services.exe (via process_creation)
Malicious Remote Command Execution via smbexec Output Redirection Pattern
Malicious Lateral Movement via PsExec File-List Target
Malicious PsExec Service Installation via PSEXESVC
Suspicious Lateral Movement via PsExec Service (via process_creation)
Possible PsExec Remote Service Installation with Randomly Named Service (via security)
Windows Named Pipe Created for CSExec Default Pipe Name
Windows Registry Service Install Indicators for Cobalt Strike Staging
Windows Named Pipe Creation: Default RemCom Pipe Name
Pivot detection · T1021.002 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.