Inter-Process Communication - Remote Named Pipe Creation

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•1

This rule detects attempts to create a remote named pipe over SMB (Server Message Block) protocol. It specifically looks for TCP traffic directed to port 445 (SMB) on the home network, containing both the SMB signature (FF SMB) and the string "\pipe\" (case-insensitive), indicating an attempt to access or create a named pipe. This activity is often associated with inter-process communication, which can be leveraged by attackers for various purposes, including lateral movement, service execution, or privilege escalation.