Qakbot Named Pipe Activity by Suspicious Processes

This analytic detects suspicious activity involving named pipes, specifically focusing on processes known to be abused by Qakbot. It identifies the creation or connection to randomly generated named pipes in GUID format, which is a characteristic behavior of Qakbot malware for inter-process communication after code injection. This activity is indicative of a potential Qakbot infection, which could lead to unauthorized data access and exfiltration.