Potentially Suspicious Named Pipe Created Via Mkfifo in /tmp/
Detects the creation of a new named pipe using the "mkfifo" utility in a potentially suspicious location, specifically within the /tmp/ directory. Named pipes can be used for inter-process communication and their creation in temporary directories might indicate malicious activity such as local privilege escalation or data exfiltration.
Sigma
