Detecting Named Pipe Abuse: C2 and Lateral Movement via T1134.001

Named pipes are Windows inter-process communication channels — they allow processes on the same host or across the network to pass data. Legitimate uses include SQL Server, print spooling, and browser IPC. The problem for defenders is that post-exploitation frameworks use them extensively: for parent-to-child implant communication, for token impersonation during privilege escalation, and for peer-to-peer C2 relay in environments where only some hosts have internet access.

Detection is achievable. Sysmon exposes pipe creation and connection events that most frameworks don’t meaningfully obfuscate. Known offensive pipe name patterns are distinctive. The gap is usually logging coverage: Sysmon must be deployed and Event IDs 17/18 must be enabled in the configuration.

MITRE ATT&CK Mapping

How Post-Exploitation Frameworks Use Named Pipes

Cobalt Strike

Cobalt Strike’s default Beacon uses named pipes in two scenarios:

Peer-to-peer C2: In environments where only a subset of hosts can reach the internet, Cobalt Strike uses pipe-over-SMB to relay C2 from a “linked” Beacon on an internal host through an internet-facing Beacon. Commands travel over the SMB protocol to a named pipe on the internal host. This bypasses egress filtering on the internal host entirely.

Post-exploitation modules: Cobalt Strike’s execute-assembly, elevate, and shinject modules communicate with injected threads via a named pipe. The pipe is created by the BOF or injected shellcode and connected by Beacon’s parent process to read output.

Default Cobalt Strike pipe names are well-known and should be treated as high-confidence indicators:

• \MSSE-<number>-server
• \postex_<hex>
• \postex_ssh_<hex>
• \status_<hex>
• \msagent_<hex>
• \mojo.<number>.<number>.<number> (Chrome-inspired names used in some profiles)

Havoc C2

Havoc uses similar pipe-based SMB communication for multi-pivot networks. Default pipe names include \havc and variations including hex-suffixed patterns.

Token Impersonation via Pipe

This technique predates modern C2 frameworks and is used for privilege escalation. The pattern:

1. Attacker-controlled process creates a named pipe server via CreateNamedPipe
2. A higher-privileged process (SYSTEM service, scheduled task) is coerced into connecting — via DDE, COM, leaked UNC paths, or printer spooler abuse
3. The attacker calls ImpersonateNamedPipeClient after the connection
4. The current thread now runs in the security context of the privileged process

This produces a SYSTEM-level token from a lower-privileged starting point. It is the mechanism behind tools like PrintSpoofer, RoguePotato, and SweetPotato.

Detection Surface 1: Sysmon Events 17 and 18

Sysmon Event 17 logs named pipe creation (PipeEventCreateLog). Sysmon Event 18 logs named pipe connection (PipeEventConnectLog). Both must be explicitly enabled in the Sysmon configuration:

<PipeMonitoring onmatch="include">
  <PipeName condition="contains">\postex</PipeName>
  <PipeName condition="contains">\MSSE-</PipeName>
  <PipeName condition="contains">\status_</PipeName>
  <PipeName condition="contains">\msagent_</PipeName>
  <PipeName condition="contains">\havc</PipeName>
</PipeMonitoring>

Event 17 fields: UtcTime, ProcessGuid, ProcessId, PipeName, Image, User Event 18 fields: UtcTime, ProcessGuid, ProcessId, PipeName, Image, User

Sigma Rule 1: Known Offensive Named Pipe Names (Sysmon 17/18)

title: Offensive Framework Named Pipe - Known C2 Patterns
id: f4a7b2c1-9e3d-4f8a-b1c2-3d4e5f6a7b8c
status: stable
description: Detects creation or connection to named pipes with names matching known offensive post-exploitation frameworks
author: SOC Analyst Hub
date: 2026/07/25
tags:
  - attack.lateral_movement
  - attack.command_and_control
  - attack.t1071
  - attack.t1134.001
logsource:
  product: windows
  category: pipe_created
detection:
  selection:
    PipeName|contains:
      - '\postex_'
      - '\postex_ssh_'
      - '\MSSE-'
      - '\status_'
      - '\msagent_'
      - '\havc'
      - '\meterpreter'
      - '\DserNamePipe'
      - '\comnap'
      - '\lsadump'
  condition: selection
falsepositives:
  - None expected for these specific patterns
level: high

title: Offensive Framework Named Pipe Connection (Event 18)
id: c3b4d5e6-f7a8-4b9c-0d1e-2f3a4b5c6d7e
status: stable
description: Detects connections to named pipes matching offensive framework patterns (Sysmon Event 18)
author: SOC Analyst Hub
date: 2026/07/25
tags:
  - attack.lateral_movement
  - attack.t1071
logsource:
  product: windows
  category: pipe_connected
detection:
  selection:
    PipeName|contains:
      - '\postex_'
      - '\MSSE-'
      - '\msagent_'
      - '\status_'
      - '\havc'
  condition: selection
falsepositives:
  - None expected
level: high

Sigma Rule 2: Suspicious Pipe Creation from Unusual Process

title: Named Pipe Created from Suspicious Process Context
id: a1b2c3d4-e5f6-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects named pipe creation from processes that should not be creating pipes — indicates potential post-exploitation activity or process injection
author: SOC Analyst Hub
date: 2026/07/25
tags:
  - attack.t1134.001
  - attack.defense_evasion
logsource:
  product: windows
  category: pipe_created
detection:
  selection:
    Image|endswith:
      - '\mshta.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\regsvr32.exe'
      - '\rundll32.exe'
      - '\cmd.exe'
      - '\powershell.exe'
      - '\wmic.exe'
  filter_legit:
    PipeName|startswith:
      - '\PSHost'  # PowerShell remoting
  condition: selection and not filter_legit
falsepositives:
  - PowerShell remoting via named pipe (filter with PipeName PSHost prefix)
  - Some legitimate administration tools
level: medium

KQL: Microsoft Sentinel / Defender XDR (DeviceEvents)

For endpoints with MDE, pipe events surface in DeviceEvents with ActionType values NamedPipeEvent:

// Known offensive named pipe names — high confidence
DeviceEvents
| where ActionType == "NamedPipeEvent"
| extend PipeName = tostring(parse_json(AdditionalFields).PipeName)
| where PipeName has_any ("postex_", "MSSE-", "msagent_", "status_", "havc", "meterpreter")
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessParentFileName, PipeName, AccountName
| order by Timestamp desc

// Pipe creation from scripting hosts — medium confidence, investigate
DeviceEvents
| where ActionType == "NamedPipeEvent"
| extend PipeName = tostring(parse_json(AdditionalFields).PipeName)
| where InitiatingProcessFileName in~ ("mshta.exe", "wscript.exe", "cscript.exe", "regsvr32.exe", "rundll32.exe")
| where PipeName !startswith "\\PSHost"
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, PipeName, InitiatingProcessParentFileName
| order by Timestamp desc

// SMB named pipe lateral movement — look for remote pipe connections
// Requires Windows Security event 5145 (Object Access, Network Share) with detailed tracking
SecurityEvent
| where EventID == 5145
| where ObjectName has "IPC$"
| where RelativeTargetName has_any ("postex_", "MSSE-", "msagent_", "havc")
| project TimeGenerated, Computer, IpAddress, Account, RelativeTargetName

Hunting: Finding Custom Pipe Names

Not all offensive pipe names are known patterns. Hunters can look for unusual pipe creation volume and process context anomalies:

// Baseline named pipe creation by process image — find outliers
DeviceEvents
| where ActionType == "NamedPipeEvent"
| where Timestamp > ago(7d)
| extend PipeName = tostring(parse_json(AdditionalFields).PipeName)
| summarize PipeCount = count(), Pipes = make_set(PipeName, 20) by InitiatingProcessFileName, DeviceName
| where PipeCount > 10
| order by PipeCount desc

Cobalt Strike with custom profiles will use random or modified pipe names. The process context is often more reliable than pipe name matching: Beacon running inside svchost.exe, dllhost.exe, or rundll32.exe creating any named pipe warrants investigation.

Hardening and Coverage Gaps

Ensure Sysmon 17 and 18 are enabled and ingested. Without these events, named pipe activity is invisible in standard Windows logs. Windows Security Event 4656 (object handle requested) with audit object access policies can supplement this but produces very high volume. SMB-based pipe traffic appears in network flow data as SMB connections to IPC$ shares on destination hosts — worth baselining in east-west network monitoring.

For blocking: AppLocker and WDAC policies can restrict named pipe creation to allowlisted processes, but tuning is complex. Endpoint detection via Sysmon and EDR telemetry is the practical first layer.