Komari C2 - Named Pipe IPC for Command Routing (T1071.004)
Identifies the creation of Named Pipes by the suspected agent process, used by Komari for Inter-Process Communication (IPC) and routing shell output. The rule correlates NamedPipeEvent with DeviceNetworkEvents to ensure the initiating process also has network activity to a remote IP, and specifically looks for named pipes matching a regex pattern often used by Komari.
Microsoft Sentinel (KQL)
