Matanbuchus DLL Injection Named Pipe

Tim Peck@timpeck

•updated Dec 3, 2025•0•76

Detects the creation of a named pipe with the format `\.\pipe\dll-%hex_encoded_PID%`. This behavior is associated with the Matanbuchus malware, which uses this technique to inject a DLL payload into a remote msiexec.exe process.