NtdllPipe Like Activity Execution

SigmaHQ Detections@sigmaHQ

•updated Apr 28, 2026•0•0•0

Detects command that type the content of ntdll.dll to a different file or a pipe in order to evade AV / EDR detection. As seen being used in the POC NtdllPipe