Named Pipe Impersonation by Medium/Low Integrity Process - T1134.001

Ibrahim Saud@tektrix

•updated Jun 23, 2026•0•0•5

Detects suspicious named pipe server creation by Medium/Low integrity processes followed by a SYSTEM-level process spawned from the same initiating process within a short correlation window. This behavior is indicative of an attacker attempting to escalate privileges using named pipe impersonation.