PAExec Default Named Pipe Creation

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•13

Detects the creation of a named pipe with a name starting with '\PAExec', which is the default named pipe used by the PAExec utility. This can indicate remote execution activity using PAExec.