Privilege Escalation via Named Pipe Impersonation
This rule detects the creation of a named pipe using `cmd.exe` or `powershell.exe` by looking for specific command-line arguments. The presence of `echo`, `>` and `\\.\pipe\` in the command line indicates an attempt to create or interact with a named pipe. This activity can be associated with privilege escalation techniques, where an attacker might use named pipes for inter-process communication to elevate privileges.
Sigma
