Cobalt Strike Named Pipe Indicators via DeviceEvents
Detects the use of known named pipes associated with Cobalt Strike post-exploitation frameworks, often used for inter-process communication during beaconing or lateral movement.
Microsoft Sentinel (KQL)
