PIVOTPIPE SMB Named Pipe P2P Beacon Relay Between Hosts

Ibrahim Saud@tektrix

•updated 19 days ago•0•0•1

This rule detects the creation of named pipes commonly used by Cobalt Strike beaconing payloads (e.g., those starting with 'nb_', 'pivot_', or 'beacon_'). The detection excludes known system processes that might otherwise generate similar traffic, focusing on suspicious inter-process communication.