Trickbot Named Pipe Activity Detection

This analytic detects the creation or connection to a named pipe associated with Trickbot malware. It specifically looks for Sysmon EventCodes 17 (Pipe Created) and 18 (Pipe Connected) where the PipeName matches the pattern "\\pipe\\*lacesomepipe". This activity is significant because Trickbot uses named pipes for inter-process communication, often for C2 communication, data exfiltration, and command execution. Detecting this behavior can help identify Trickbot infections, which could lead to persistence, arbitrary command execution, and sensitive information exfiltration.