Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
39 detections
Filters
Last updated
All Time
Detection languages
14
14
6
3
2
Contributors
14
4
4
3
2
Categories
39
8
8
6
5
Platforms
39
Products / Services
22
13
5
4
3
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
2
1
This rule detects internal strings associated with the SPECTRALVIPER framework, specifically identifying commands related to the orchestration of lateral movement via named pipes. These indicators suggest active post-exploitation movement using custom pivot links and pipe communication.
This rule detects potentially malicious behavior associated with driver and inter-process communication, specifically targeting the creation or interaction with 'C:\ProgramData\402.sys', usage of IOCTL control code '2248E0', or activity involving the 'NSecKrnl' named pipe. These indicators are often associated with rootkit-like persistence or kernel-mode communication used by malware.
Detects the Chromelevator loader, identified as 'drun.exe', performing reflective DLL injection of 'payload.dll' using direct syscalls (NtAllocateVirtualMemory, NtCreateThreadEx) and inter-process communication (IPC) via a named pipe ('__DLL_PIPE_COMPLETION_SIGNAL__'). The rule looks for process creation, remote thread creation, memory protection modifications, file creation/modification of 'payload.dll', and specific named pipe events associated with 'drun.exe'.
This rule detects the creation of named pipes or mutexes with GUID-like naming patterns by non-system processes. Threat actors frequently use uniquely generated GUIDs for IPC mechanisms like named pipes and mutexes to coordinate between processes or to check for existing infection, often to avoid detection by using non-obvious names.
This rule detects the creation of named pipes or mutexes with GUID-like naming patterns by non-system processes. Threat actors frequently use uniquely generated GUIDs for IPC mechanisms like named pipes and mutexes to coordinate between processes or to check for existing infection, often to avoid detection by using non-obvious names.
This rule detects potential rootkit activity by monitoring for specific DeviceIoControl requests (code 2248E0), the presence of a suspicious file (402.sys) in the ProgramData directory, and specific NamedPipe events (NSecKrnl). These indicators are often associated with kernel-level malicious implants or rootkits attempting to hide their presence or interact with the system at a low level.
Detects suspicious named pipe server creation by Medium/Low integrity processes followed by a SYSTEM-level process spawned from the same initiating process within a short correlation window. This behavior is indicative of an attacker attempting to escalate privileges using named pipe impersonation.
Detects processes associated with Prinz Eugen ransomware attempting to access shared memory, mailslots, named pipes, or create file mappings. This behavior is indicative of inter-process communication mechanisms often used by malware for various purposes, including data exfiltration, command and control, or privilege escalation.
Detects a single process creating several named pipes, which is indicative of the Kazuar malware's communication mechanism between its Kernel, Bridge, and Worker modules. The rule specifically looks for a process creating 3 or more unique named pipes within a 10-minute window.
Detects the creation or connection to the named pipe '\REDSUN' which is known to be used by the RedSun exploit (CVE-2026-41091) for inter-process communication. This rule monitors both Microsoft Defender for Endpoint events and Sysmon Event IDs 17 and 18 for named pipe activity.
Detects the creation of the specific named pipe '\REDSUN' used by the RedSun exploit (CVE-2026-41091) for inter-process communication. This named pipe is a unique indicator of the RedSun exploit's activity, often associated with process injection or other inter-process communication mechanisms.
Detects the creation of the '\REDSUN' named pipe, which is used by the CVE-2026-41091 exploit for inter-process communication. This pipe facilitates the transfer of session ID information between the user-level exploit and the SYSTEM-level payload.
This rule detects suspicious activity related to 'wermgr.exe' or the named pipe 'MiniPlasmaWERPipe'. 'wermgr.exe' is the Windows Error Reporting process, and its execution from non-standard paths can indicate compromise or abuse. The 'MiniPlasmaWERPipe' named pipe has been associated with malware for inter-process communication. Detection is based on Windows Security Event Log (EventCode 4688 for process creation) or Sysmon Operational logs (EventCode 1 for process creation, 17 for pipe creation, 18 for pipe connection).
This rule detects the creation or connection to a named pipe with the specific name 'REDSUN'. This activity is associated with the RedSun PoC (Proof of Concept) for CVE-2026-33825, a zero-day vulnerability in Windows Defender. The rule looks for events indicating named pipe creation or connection across various security event sources, including Falcon native events and Sysmon events (Event IDs 17 and 18).
https://github.com/Nightmare-Eclipse/RedSun/blob/main/README.md
This rule detects activities associated with the 'CTRL' Russian .Net access framework. It looks for a combination of a hidden PowerShell stager, UAC bypass attempts via registry modification (ms-settings), and the launch of fodhelper.exe. Additionally, it requires the presence of at least one of the following: disguised registry payload storage, FRP configuration file staging, keylogger artifact creation, named pipe creation ('ctrlPipe'), RDP tampering artifacts, or PowerShell commands related to Windows Defender exclusion changes.
Detects a command-line pattern associated with the Metasploit 'getsystem' command. This technique involves echoing a string into a named pipe to elevate privileges to SYSTEM, often executed via a newly created service.
Detects the creation of a set of four named pipes with a specific naming convention (`[random]_stdin_read`, `[random]_stdin_write`, etc.), a behavior consistent with the EndClient RAT used by Kimsuky to establish a remote shell.
Detects the creation of remote scheduled tasks by monitoring access to the 'atsvc' named pipe over SMB. This activity is indicative of using tools like 'at.exe' or direct API calls to schedule tasks on a remote system, which can be leveraged for privilege escalation, execution, lateral movement, or persistence.
The following analytic detects the use of default or publicly known named pipes associated with Cobalt Strike. It leverages Sysmon EventID 17 and 18 to identify specific named pipes commonly used by Cobalt Strike's Artifact Kit and Malleable C2 Profiles. This activity is significant because Cobalt Strike is a popular tool for adversaries to conduct post-exploitation tasks, and identifying its named pipes can reveal potential malicious activity. If confirmed malicious, this could indicate an active Cobalt Strike beacon, leading to unauthorized access, data exfiltration, or further lateral movement within the network.
This rule detects the creation of specific named pipes ('\imposecost' or '\imposingcost') which are known to be used by the 'Koh' tool. The 'Koh' tool is associated with credential access and privilege escalation techniques, often involving token impersonation or theft. Detection relies on Sysmon Event ID 17 or 18, which logs named pipe creation.
Page 1 of 2