Inter-Process Communication - Suspicious Pipe Data Transfer
This rule detects suspicious inter-process communication (IPC) activity involving named pipes. Specifically, it looks for network traffic within the home network ($HOME_NET to $HOME_NET) that contains the string "\\.\pipe\\" (case-insensitive) and has a data payload size greater than 1000 bytes. This pattern is often associated with malware or advanced persistent threats (APTs) using named pipes for communication, especially when large amounts of data are transferred, indicating potential data exfiltration or command and control (C2) activity.
Suricata
