huntrule

Windows Named Pipe Created for CSExec Default Pipe Name

Alerts on Windows named pipe creations with pipe names containing \csexecsvc, matching CSExec’s default pipe.

FreeReviewedSigma · Medium · v2
Product
windows
Category
pipe_created
Author
Nikita Nazarov, oscd.community, Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2023-08-07
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Execution → Lateral Movement

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies the creation of Windows named pipes whose name contains the default CSExec service marker (\csexecsvc). Attackers may use CSExec-style named pipes for command execution and lateral movement, making pipe creation telemetry a useful indicator. The rule relies on Windows named pipe creation events (e.g., Sysmon Event ID 17/18) that include the pipe name for pattern matching.

Reporting behind it

Related detections9 linkedT1021.002 — drag to rearrange
Malicious PsExec Service Installation via PSEXESVC
Suspicious Lateral Movement via PsExec Service (via process_creation)
Possible PsExec Remote Service Installation with Randomly Named Service (via security)
Windows Named Pipe Creation: Default RemCom Pipe Name
Windows Registry Service Install Indicators for Cobalt Strike Staging
Windows Service Control Manager Events: Suspicious Service Install Paths used by Cobalt Strike
Windows Security 4697 Alerts for Service Installations Using Cobalt Strike Beacon Payloads
Windows rundll32.exe execution with no parameters or arguments
Windows Service Installation (EID 4697) for SMB PsExec by Metasploit or Impacket
Windows Named Pipe Created for CSExec Default Pipe Name
Pivot detection · T1021.002 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.