SPECTRALVIPER XGU Pivot Shadow named pipe lateral movement

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•1

Detects SPECTRALVIPER lateral movement activity utilizing the XGU Pivot Shadow technique. The rule monitors for named pipe creation or connection events involving specific host processes (IntelAudioService.exe and OneDrive.Sync.Services.exe) used to orchestrate inter-instance command and control distribution. It also flags potential sideloading behavior where IntelAudioService.exe is executed from an anomalous path within the user profile.