Beacon SMB named pipe relay: rundll32 pipe creation plus SMB east-west
Detects rundll32.exe creating a named pipe and subsequently establishing an SMB (port 445) connection to a private IP address within a 10-minute window, indicative of potential lateral movement or internal reconnaissance.
Microsoft Sentinel (KQL)
