Cobalt Strike / Metasploit Suspicious Named Pipe Creation

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•1

Detects the creation of named pipes with names frequently associated with common post-exploitation tools, such as Cobalt Strike. The rule filters out common browser processes and critical Windows system processes to reduce noise.