Inter-Process Communication - Named Pipe Access via SMB

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•3

This rule detects attempts to access named pipes via Server Message Block (SMB) on port 445. It specifically looks for the SMB signature and the 'IPC$' string within the traffic, indicating an attempt to establish an Inter-Process Communication (IPC) connection. A threshold is set to trigger an alert if 10 such events occur from the same source within 30 seconds, which could indicate enumeration or exploitation attempts.