Suspicious UI Automation Named Pipe Creation

Prashanth P@prashanthblogs

•updated Jul 31, 2025•1•38

Detects creation of named pipes with UIA_PIPE_ prefix, which are used by Microsoft's UI Automation framework. This activity may indicate malicious use of UI Automation for credential theft or unauthorized UI interaction. Coyote malware has been observed using UI Automation to extract credentials from banking applications.