Cobalt Strike Beacon Named Pipe C2 Detection via Sysmon EID 17/18

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•8

This rule monitors for Cobalt Strike Beacon named pipe C2 patterns by analyzing Sysmon event IDs 17 (Pipe Created) and 18 (Pipe Connected). It specifically flags known default Cobalt Strike pipe naming conventions (e.g., 'MSSE-', 'postex_ssh_', 'msagent_') and common randomized short alphanumeric pipe names while excluding legitimate Windows system pipes.