All Detections

HackTool - DiagTrackEoP Default Named Pipe

Yamato Security Hayabusa@YamatoSecurityHayabusa
updated Jun 24, 202504

Detects creation of default named pipe used by the DiagTrackEoP POC, a tool that abuses "SeImpersonate" privilege.

Sigma