Kazuar Bridge Module Creates Multiple Named Pipes

Daniel Jeremiah@daniyyell

•updated Jun 21, 2026•0•0•1

Detects a single process creating several named pipes, which is indicative of the Kazuar malware's communication mechanism between its Kernel, Bridge, and Worker modules. The rule specifically looks for a process creating 3 or more unique named pipes within a 10-minute window.