Adaptix BeaconSMB named pipe creation followed by SMB pipe connection

ills3c Intel&Coffee@Ills3C

•updated 2 days ago•3•0•4

Detects when a non-system process creates a named pipe with a non-standard name, followed within 10 minutes by an inbound SMB connection (port 445) from another host to the same device. This behavior can indicate lateral movement or post-exploitation framework activities like Adaptix using named pipes and SMB.