PIVOTPIPE TCP Beacon P2P Lateral Movement Between Internal Hosts

Ibrahim Saud@tektrix

•updated Sep 21, 2026•0•0•3

Detects PIVOTPIPE malware beaconing activity indicative of peer-to-peer (P2P) lateral movement between internal hosts. The rule monitors for sustained established TCP traffic with specific small packet size characteristics, suggesting command-and-control heartbeats or tunneled traffic within the internal network.