Nightmare Eclipse - Cobalt Strike Pipe Activity (T1055)

Ibrahim Saud@tektrix

•updated Jun 22, 2026•1•0•9

Identifies the creation of named pipes matching standard Cobalt Strike malleable C2 profiles (\pipe\msagent, \pipe\postex, \pipe\status, \pipe\spoolss) that are associated with network activity, indicating advanced C2 deployment.