SPECTRALVIPER XGU Pivot Shadow Named Pipe Lateral Movement

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects potential lateral movement activity associated with the SPECTRALVIPER actor by monitoring OneDrive.Sync.Service.exe for the initiation of named pipe connections. The detection specifically targets anomalous orchestration patterns using the XGU::Feature::Pivot Shadow module and XGU::Pivot::StartLink, which utilize named pipes for inter-process communication across systems.