How do you detect named-pipe C2?

Detect named-pipe (SMB peer-to-peer) C2 inside the network, since linked beacons keep most hosts off the perimeter. Enable Sysmon pipe logging (Event 17 created, 18 connected) and alert on default/weak pipe names (msagent_##, postex_####) or pipes created by injected processes such as an argument-less rundll32. Then correlate with Windows Event 5145 (IPC$ share access) and Zeek SMB logs to reconstruct the peer chain — the topology where only one host reaches the internet and others link through it over port 445 is the giveaway. Baseline legitimate application pipes first.

Detecting Named-Pipe and SMB Peer-to-Peer C2

To reduce egress noise, operators link beacons peer-to-peer over SMB named pipes: one internet-facing beacon relays for several internal ones. This keeps most hosts off the perimeter entirely, so detection moves inside — to named-pipe creation and connection events and the lateral SMB sessions that carry them.

Signals at a Glance

Signal	Where	ATT&CK
Default/weak pipe names (msagent_##, postex_####)	Sysmon 17/18	T1090.001
Pipe created by an injected/unusual process	Sysmon 17 + 8/10	T1055
SMB session to peer on 445 carrying pipe traffic	Zeek smb, Event 5145	T1021.002
Chain of internal hosts each hosting a pipe	Correlated Sysmon	T1090.001

Hunting Pipe Events

Enable Sysmon pipe logging (Event ID 17 created, 18 connected) and alert on default or anomalous pipe names, especially when the creating process is injected or atypical:

title: Suspicious Named Pipe for SMB Peer C2
logsource:
  product: windows
  category: pipe_created
detection:
  known_bad:
    PipeName|re: '\\(msagent_..|postex_....|status_..|MSSE-....-server)'
  anomalous_creator:
    Image|endswith:
      - '\\rundll32.exe'
      - '\\dllhost.exe'
      - '\\werfault.exe'
  condition: known_bad or anomalous_creator
level: high
# Baseline legitimate pipes (many apps use them) before enabling broadly.

Following the Chain

Correlate pipe events with Windows Event 5145 (detailed file-share access to IPC$) and Zeek SMB logs to see which host connected to which pipe.
Map the peer links: a chain where host A connects to a pipe on B, B to C, with only A reaching the internet, is the classic linked-beacon topology.
Alert on an internal host accepting SMB pipe connections from peers it has no business talking to, especially off normal admin paths.
Pair with process-injection detection — peer beacons are usually injected, not standalone binaries.

Vetted sources

SigmaHQ ships named-pipe detections for common C2 defaults; enable Sysmon config (SwiftOnSecurity/Olaf Hartong) for pipe events and tune out legitimate application pipes. Combine pipe telemetry with SMB (Event 5145, Zeek) to reconstruct the peer chain.

Build Detections That Fire

Mjolnir Security helps blue teams turn threat intelligence into high-fidelity detections across endpoint, network, identity and cloud telemetry.

Detection EngineeringManaged Detection & ResponseThreat HuntingIncident ResponsePurple Teaming

Detection Engineering We build and tune detections mapped to ATT&CK from your own telemetry.
Threat Hunting as a Service Hypothesis-driven hunts for the behaviours on this page.
24/7 Incident Response Containment when a detection fires. Call +1 833 403 5875.

Written by: Mjolnir Threat Research (MTAC)  |  Published: October 12, 2026  |  Last reviewed: October 12, 2026

Signals at a Glance

Hunting Pipe Events

Following the Chain

Build Detections That Fire

C2 Beaconing Detection

Detection Hub

Lateral Movement Detection