+Named Pipe Metadata

Named Pipe Metadata

Contextual data about a named pipe on a system, including pipe name and creating process (ex: Sysmon EIDs 17-18)

Data Collection Measures:

  • Windows:
  • Sysmon Event ID 17: Logs the creation of a named pipe.
  • Sysmon Event ID 18: Logs connection attempts to a named pipe.
  • Windows Security Event ID 5145: Logs access attempts to named pipes via SMB shares.
  • ETW (Event Tracing for Windows): Provides deep telemetry into named pipe interactions.
  • Linux/macOS:
  • AuditD (mkfifo, open, read, write syscalls): Tracks FIFO (named pipe) creation and usage.
  • Lsof (lsof -p <PID> or lsof | grep PIPE): Lists active named pipes and associated processes.
  • Strace (strace -e open <process>): Monitors named pipe interactions.
  • Endpoint Detection & Response (EDR):
  • Capture named pipe events as part of process tracking.
  • Memory Forensics:
  • Volatility Plugin (pipescan): Enumerates named pipes in system memory.
  • Rekall Framework: Identifies active named pipes and associated processes.

1. Übersicht

1.1 Referenzen

1.2 Identifizierte Anforderungen

1.3 Zugehörige Regulierungen

2. Identifizierte Anforderungen

Anforderungen

3. Zugehörige Regulierungen

Regulierungen

Verknüpfte Vorgänge

Verknüpfungen
is related to Data Components
  • MITREATTACK -

    EN: MITRE ATT&CK®, https://attack.mitre.org/. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. License: The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. See the Terms of Use for the disclaimers. ATT&CK® is a registered trademark of The MITRE Corporation. Converted into the GRCA format.

    DE: MITRE ATT&CK®, https://attack.mitre.org/. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE erlaubt die Nutzung für Forschung, Entwicklung und kommerzielle Zwecke, wenn jede Kopie den Urheberrechtsvermerk und die Lizenz enthält; maßgeblich ist der englische Wortlaut der Lizenz oben und die Terms of Use mit den Haftungsausschlüssen. ATT&CK® ist eine eingetragene Marke der MITRE Corporation. In das GRCA-Format umgewandelt.