Ted Backdoor FIFO Pipe Creation Under /tmp for C2 Tunneling

Arnold Chan@slaz

•updated Sep 5, 2026•0•0•1

Detects the creation or modification of files within the /tmp directory that follow a specific naming convention (t[number]_w.pipe) by an HAProxy process. This pattern is often associated with inter-process communication or potential post-exploitation activity where HAProxy is leveraged to handle named pipes for malicious command execution or data redirection.