Windows Named Pipe Creation Alert for Known Malicious Pipe Names
Alert on Windows named pipe creations where the PipeName matches known malware-associated pipe identifiers.
FreeReviewedSigma · Critical · v2
- Product
- windows
- Category
- pipe_created
- Author
- Florian Roth (Nextron Systems), blueteam0ps, elhoim (SigmaHQ), DRL 1.1
- Published
- 2017-11-06
- Updated
- 2026-07-31
ATT&CK techniques
Priv Esc → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags creation of Windows named pipes when the pipe name matches a set of identifiers associated with known malware and threat tools. Named pipes can be used for covert inter-process communication, staging, and payload control, helping attackers blend into normal Windows functionality. It relies on telemetry from Windows named pipe creation events, typically provided by Sysmon pipe event logging.
Reporting behind it
- securelist.comhttps://securelist.com/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/71275/
- securelist.comhttps://securelist.com/faq-the-projectsauron-apt/75533/
- web.archive.orghttps://web.archive.org/web/20180725233601/https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf
- us-cert.govhttps://www.us-cert.gov/ncas/alerts/TA17-117A
- fireeye.comhttps://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html
- thedfirreport.comhttps://thedfirreport.com/2020/06/21/snatch-ransomware/
- github.comhttps://github.com/RiccardoAncarani/LiquidSnake
- accenture.comhttps://www.accenture.com/us-en/blogs/cyber-defense/turla-belugasturgeon-compromises-government-entity
- us-cert.cisa.govhttps://us-cert.cisa.gov/ncas/analysis-reports/ar19-304a
- download.bitdefender.comhttps://download.bitdefender.com/resources/files/News/CaseStudies/study/115/Bitdefender-Whitepaper-PAC-A4-en-EN1.pdf
- unit42.paloaltonetworks.comhttps://unit42.paloaltonetworks.com/emissary-panda-attacks-middle-east-government-sharepoint-servers/
- thedfirreport.comhttps://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/pipe_created/pipe_created_susp_malicious_namedpipes.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-named-pipe-creation-by-known-malware-pipe-names-fe3ac066
title: Windows Named Pipe Creation Alert for Known Malicious Pipe Names
id: cb075cc7-926e-4d1f-b1ee-6775b77ffbf5
status: test
description: This rule flags creation of Windows named pipes when the pipe name matches a set of identifiers associated with known malware and threat tools. Named pipes can be used for covert inter-process communication, staging, and payload control, helping attackers blend into normal Windows functionality. It relies on telemetry from Windows named pipe creation events, typically provided by Sysmon pipe event logging.
references:
- https://securelist.com/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/71275/
- https://securelist.com/faq-the-projectsauron-apt/75533/
- https://web.archive.org/web/20180725233601/https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf
- https://www.us-cert.gov/ncas/alerts/TA17-117A
- https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html
- https://thedfirreport.com/2020/06/21/snatch-ransomware/
- https://github.com/RiccardoAncarani/LiquidSnake
- https://www.accenture.com/us-en/blogs/cyber-defense/turla-belugasturgeon-compromises-government-entity
- https://us-cert.cisa.gov/ncas/analysis-reports/ar19-304a
- https://download.bitdefender.com/resources/files/News/CaseStudies/study/115/Bitdefender-Whitepaper-PAC-A4-en-EN1.pdf
- https://unit42.paloaltonetworks.com/emissary-panda-attacks-middle-east-government-sharepoint-servers/
- https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/pipe_created/pipe_created_susp_malicious_namedpipes.yml
author: Florian Roth (Nextron Systems), blueteam0ps, elhoim, Huntrule Team
date: 2017-11-06
modified: 2023-08-07
tags:
- attack.privilege-escalation
- attack.stealth
- attack.t1055
logsource:
product: windows
category: pipe_created
definition: Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575
detection:
selection:
PipeName:
- \46a676ab7f179e511e30dd2dc41bd388
- \583da945-62af-10e8-4902-a8f205c72b2e
- \6e7645c4-32c5-4fe3-aabf-e94c2f4370e7
- \9f81f59bc58452127884ce513865ed20
- \adschemerpc
- \ahexec
- \AnonymousPipe
- \bc31a7
- \bc367
- \bizkaz
- \csexecsvc
- \dce_3d
- \e710f28d59aa529d6792ca6ff0ca1b34
- \gruntsvc
- \isapi_dg
- \isapi_dg2
- \isapi_http
- \jaccdpqnvbrrxlaf
- \lsassw
- \NamePipe_MoreWindows
- \pcheap_reuse
- \Posh*
- \rpchlp_3
- \sdlrpc
- \svcctl
- \testPipe
- \winsession
condition: selection
falsepositives:
- Unknown
level: critical
license: DRL-1.1
related:
- id: fe3ac066-98bb-432a-b1e7-a5229cb39d4a
type: derived