Suspicious Driver and Named Pipe Activity Detected

nomit vyas@xoxo

•updated Jun 25, 2026•0•0•7

This rule detects potentially malicious behavior associated with driver and inter-process communication, specifically targeting the creation or interaction with 'C:\ProgramData\402.sys', usage of IOCTL control code '2248E0', or activity involving the 'NSecKrnl' named pipe. These indicators are often associated with rootkit-like persistence or kernel-mode communication used by malware.