Alternate PowerShell Hosts Named Pipe Creation

SigmaHQ Detections@sigmaHQ

•updated Oct 9, 2025•0•15

Detects the creation of named pipes by alternate PowerShell hosts, which might be used to bypass detections specifically looking for `powershell.exe`. This rule identifies processes that create named pipes starting with '\PSHost' but are not the standard PowerShell executables or other common legitimate processes that might use such pipes.