Makop Ransomware - Named Pipe Peeking (Coordination) via Event Pattern

Ibrahim Saud@tektrix

•updated Jun 20, 2026•0•0•2

Detects the creation of named pipes associated with newly created hex-named executables, indicating Makop multi-threaded coordination. The rule correlates file creation events for executables with hexadecimal names (e.g., '64-character-hex.exe') with subsequent named pipe creation events by the same process within a 10-minute window on the same device. This behavior is indicative of Makop ransomware's inter-process communication mechanism.