huntrule

Windows Named Pipe Created for CSExec Default Pipe Name

Alerts on Windows named pipe creations with pipe names containing \csexecsvc, matching CSExec’s default pipe.

FreeReviewedSigma · Medium · v2
Product
windows
Category
pipe_created
Author
Nikita Nazarov, oscd.community, Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2023-08-07
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Execution → Lateral Movement

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies the creation of Windows named pipes whose name contains the default CSExec service marker (\csexecsvc). Attackers may use CSExec-style named pipes for command execution and lateral movement, making pipe creation telemetry a useful indicator. The rule relies on Windows named pipe creation events (e.g., Sysmon Event ID 17/18) that include the pipe name for pattern matching.

Reporting behind it

Related detections9 linkedT1021.002 — drag to rearrange
Suspicious RemCom Service Named Pipe for Lateral Movement (via pipe_created)
Malicious PsExec Service Binary Execution from Windows Directory via services.exe (via process_creation)
Malicious Remote Command Execution via smbexec Output Redirection Pattern
Malicious Lateral Movement via PsExec File-List Target
Malicious PsExec Service Installation via PSEXESVC
Suspicious Lateral Movement via PsExec Service (via process_creation)
Possible PsExec Remote Service Installation with Randomly Named Service (via security)
Windows Named Pipe Creation: Default RemCom Pipe Name
Windows Registry Service Install Indicators for Cobalt Strike Staging
Windows Named Pipe Created for CSExec Default Pipe Name
Pivot detection · T1021.002 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.