Kimsuky Endclient RAT Remote Shell Pipes

Tim Peck@timpeck

•updated Nov 7, 2025•1•1•55

Detects the creation of a set of four named pipes with a specific naming convention (`[random]_stdin_read`, `[random]_stdin_write`, etc.), a behavior consistent with the EndClient RAT used by Kimsuky to establish a remote shell.