Dynamic Shellcode Execution via Named Pipes (T1055)

Ibrahim Saud@tektrix

•updated Jun 20, 2026•0•0•6

Detects generic instances of scripting languages (Python/PowerShell) leveraging anomalous named pipes (e.g., PipePipe!, postex) to inject or execute shellcode directly in memory.