HackTool - Koh Default Named Pipe Creation

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•22

This rule detects the creation of specific named pipes ('\imposecost' or '\imposingcost') which are known to be used by the 'Koh' tool. The 'Koh' tool is associated with credential access and privilege escalation techniques, often involving token impersonation or theft. Detection relies on Sysmon Event ID 17 or 18, which logs named pipe creation.