Suspicious named pipe
A named pipe was created or connected whose name matches a known lateral-movement tool or C2 framework (Sysmon Event ID 17/18).
What it detects
A named pipe was created or connected whose name matches a known lateral-movement tool or C2 framework (Sysmon Event ID 17/18). Remote-execution tools of the PsExec family (PsExec/PAExec/RemCom/CSExec) create service pipes with recognizable names, and Cobalt Strike's Beacon uses distinctive default pipe names (msagent_/postex_/MSSE-) for its named-pipe C2 and post-exploitation. Named-pipe names are a high-signal, hard-to-obfuscate artifact of these tools. This complements the service-based PsExec detection (7045): it catches the pipe even when the service name is randomized.
MITRE ATT&CK mapping
False positives and triage
These names are strongly attacker-associated, but a sanctioned admin using PsExec/PAExec for legitimate remote administration produces the same PsExec pipes. Confirm the source host, the account, and whether remote-exec tooling is approved on this host; the Cobalt Strike pipe names have no legitimate use. Allow-list a sanctioned admin jump host if PsExec is part of your approved tooling.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 75%. Source: rules/windows/suspicious_named_pipe.yaml, licensed under the Apache License 2.0.
id: windows.lateral.suspicious_named_pipe
version: 1.0.0
status: stable
severity: high
confidence: 0.75
platforms: [windows]
mitre_techniques: [T1021.002, T1572]
description: |
A named pipe was created or connected whose name matches a known lateral-movement tool or
C2 framework (Sysmon Event ID 17/18). Remote-execution tools of the PsExec family
(PsExec/PAExec/RemCom/CSExec) create service pipes with recognizable names, and Cobalt
Strike's Beacon uses distinctive default pipe names (msagent_/postex_/MSSE-) for its
named-pipe C2 and post-exploitation. Named-pipe names are a high-signal, hard-to-obfuscate
artifact of these tools. This complements the service-based PsExec detection (7045): it
catches the pipe even when the service name is randomized.
match:
event_action: named_pipe
file_path_contains_any:
- "PSEXESVC"
- "paexec"
- "remcom"
- "csexec"
- "msagent_"
- "postex_"
- "MSSE-"
- "cobaltstrike"
false_positive_guidance: |
These names are strongly attacker-associated, but a sanctioned admin using PsExec/PAExec
for legitimate remote administration produces the same PsExec pipes. Confirm the source
host, the account, and whether remote-exec tooling is approved on this host; the Cobalt
Strike pipe names have no legitimate use. Allow-list a sanctioned admin jump host if PsExec
is part of your approved tooling.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.