Before hunting for malicious pipes, analysts must understand how the Windows kernel handles them. A Named Pipe is a segment of shared memory that processes use to exchange data. It operates on a strict Client/Server architecture: a server process creates the pipe, and client processes connect to it to read or write data.
Under the hood, Named Pipes are managed by the Windows I/O Manager via the Named Pipe File System driver (Npfs.sys). Because Windows treats pipes as file objects, processes interact with them using standard file APIs like CreateFile, ReadFile, and WriteFile.
\\.\pipe\PipeName\Device\NamedPipe\PipeNameCrucially, Named Pipes exist only in the kernel pool memory. They leave no physical trace on the hard drive, making them the ultimate “Living off the Land” (LOTL) staging ground.
Adversaries leverage Named Pipes across three primary phases of the kill chain.
While pipes are primarily used for local IPC, Windows allows them to be accessed remotely over the network. Remote pipes are encapsulated within the Server Message Block (SMB) protocol (port 445) and accessed via the hidden IPC$ administrative share (e.g., \\Target-IP\pipe\PipeName).
This is the foundational mechanism behind tools like PsExec. Threat actors use remote pipes to push payloads and execute commands across the network, heavily obfuscating their activity within normal, highly voluminous corporate SMB traffic.
To evade network detection, modern threat actors avoid having every compromised endpoint beacon out to the internet. Instead, they establish a Peer-to-Peer (P2P) network. A primary “Egress Beacon” communicates with the external C2 server, while secondary “Child Beacons” on internal machines communicate solely with the Egress Beacon via Named Pipes over SMB. To Network Detection and Response (NDR) tools, this simply looks like internal Windows file-sharing traffic, completely masking the C2 heartbeat.
Windows provides a powerful API called ImpersonateNamedPipeClient. When a client connects to a pipe, the server creating the pipe can impersonate the client’s security token.
If an attacker identifies a highly privileged system service (running as SYSTEM) that attempts to connect to a predictable pipe name without verifying the server’s identity, the attacker can pre-emptively create that pipe. When the SYSTEM process connects, the attacker steals its token, achieving instant Local Privilege Escalation (LPE).
The abuse of Named Pipes is not limited to legacy tools. In August 2025, Microsoft Threat Intelligence published a detailed dissection of PipeMagic, a highly sophisticated, modular backdoor framework heavily relying on IPC for stealth.
Unlike traditional malware that loads all its capabilities into a single massive binary, PipeMagic operates using a microservices-like architecture entirely within memory.
The Internal Data Bus
PipeMagic utilizes Named Pipes not just for external Command & Control, but as an internal “data bus” between its loaded memory modules (e.g., keylogger, network scanner, exfiltration module). By exchanging data via pipes rather than shared memory regions or disk writes, the malware evades EDR memory scanners looking for anomalous cross-process memory allocations.
EDR Evasion
Because Named Pipe communication utilizes native, low-level NT APIs (NtCreateFile, NtFsControlFile), PipeMagic bypasses higher-level User-Mode API hooking (like kernel32.dll hooks) employed by legacy AVs, remaining virtually invisible to naive process monitoring.
Because Named Pipes leave no footprint on the NTFS file system, DFIR analysts must rely on kernel-level telemetry and network object access logs.
Sysmon is the primary tool for catching Named Pipe abuse on the endpoint.
To detect lateral movement via SMB encapsulation, analysts must monitor the Windows Security log for Event ID 5145 (A network share object was checked to see whether client can be granted access).
Share Name is \\*\IPC$ and the Relative Target Name matches known malicious pipe names.Advanced threat hunting requires identifying anomalies in the PipeName field. Adversaries typically use three naming strategies:
\pipe\msagent_* or \pipe\mojo.*.\pipe\5f3a1b...). Legitimate Windows pipes generally use structured, readable names (e.g., \pipe\spoolss).\pipe\lsass instead of the legitimate \pipe\lsass\IPC.When telemetry logs are purged or rolled over, volatile memory (RAM) is the ultimate ground truth. Because Named Pipes are managed by the Windows I/O Manager, they exist as File objects within the Kernel Pool.
DFIR analysts can extract active and recently closed Named Pipes from a memory dump using advanced forensic frameworks.
Volatility 3 can enumerate all open handles across all processes to identify active pipes.
.mem or .raw memory dump from the compromised endpoint.windows.handles.Handles plugin to list all object handles.\Device\NamedPipe\.# Execute the handles plugin and filter for Named Pipespython3 vol.py -f target_dump.raw windows.handles | grep "Device\\\NamedPipe"
# Output Example:# PID Process Type Name# 4512 powershell.exe File \Device\NamedPipe\mojo_54321MemProcFS allows analysts to mount a memory dump as a virtual file system. This makes exploring kernel objects as easy as browsing local folders.
If the pipe was recently closed, the handle might be gone, but the string may still reside in unallocated memory pages. Analysts can use bstrings (from Eric Zimmerman’s Tools) to carve pipe names directly from the raw dump or a captured pagefile.sys.
# Extracting UTF-16 strings (common in Windows memory) matching pipe patternsbstrings.exe -f target_dump.raw --ls "\Device\NamedPipe"By correlating the extracted pipe names with known C2 profiles, analysts can identify the exact malware family responsible for the intrusion, even if the primary payload has been securely wiped from disk.
While Sysmon provides excellent visibility, modern EDR solutions achieve deep inspection by directly hooking the low-level Windows APIs responsible for pipe creation.
As detailed in Synacktiv’s research on hooking Windows Named Pipes, advanced telemetry agents intercept calls to NtCreateFile and NtFsControlFile at the kernel or ntdll.dll level. By monitoring requests destined for the \Device\NamedPipe\ namespace, EDRs can analyze the pipe’s properties, assess the calling thread’s memory space for signs of injection, and evaluate the requested DACLs in real-time.
For SOC analysts and Threat Hunters relying on SIEM ingestion, identifying malicious Named Pipes involves matching known bad naming conventions and spotting suspicious parent processes (e.g., cmd.exe or powershell.exe creating a pipe server).
title: Suspicious Named Pipe Created/Connected (Cobalt Strike / Metasploit)id: 8c9d0e1f-2a3b-4c5d-6e7f-8a9b0c1d2e3fstatus: experimentaldescription: Detects the creation or connection to Named Pipes using default naming conventions associated with common C2 frameworks like Cobalt Strike and Metasploit.logsource: category: pipe_creation product: windowsdetection: # Sysmon Event ID 17 (Pipe Created) or 18 (Pipe Connected) selection: PipeName|contains: - '\mojo.5688.8052.' # Default Cobalt Strike - '\msagent_' # Default Cobalt Strike SMB Beacon - '\postex_ssh_' # Cobalt Strike SSH - '\status_' # Cobalt Strike - '\msf-pty' # Metasploit Meterpreter condition: selectionlevel: hightags: - attack.command_and_control - attack.t1090 - attack.t1570// Detects lateral movement via Named Pipes over SMB (IPC$ share)// using Windows Security Event ID 5145 (Network Share Object Access)DeviceEvents| where ActionType == "ShareAccessed"| where AdditionalFields.ShareName has "\\*\\IPC$"// Target the specific Relative Target Name (the pipe name)| where AdditionalFields.RelativeTargetName has_any ("mojo", "msagent", "postex")// Ensure the connection originated from across the network| where RemoteIPType == "Public" or RemoteIPType == "Private"| project TimeGenerated, DeviceName, RemoteIP, InitiatingProcessAccountName, AdditionalFields.RelativeTargetName| sort by TimeGenerated descNamed Pipes are an architectural necessity for the Windows operating system; they cannot be disabled or globally blocked without causing catastrophic system failure. Therefore, mitigating the threat they pose requires a defense-in-depth strategy focused on network segmentation and access control.
Everyone or BUILTIN\Users full control.