Metasploit GetSystem Named Pipe Impersonation

Elgonad .@elgonad

•updated Feb 25, 2026•1•0•87

Detects the use of Metasploit's 'getsystem' command, which creates a temporary service that executes a command to echo data into a named pipe. This is a common technique for privilege escalation via named pipe impersonation.