Windows Process With Named Pipe In Command Line

This analytic detects processes with command lines containing named pipes. This behavior is often used by adversaries for inter-process communication post-injection, aiding in defense evasion and privilege escalation. The rule specifically excludes processes originating from common program file paths to reduce false positives. If confirmed malicious, this activity could allow attackers to maintain persistence, escalate privileges, or evade defenses, potentially leading to further compromise of the system.