CRAT Named Pipe Payload Delivery via ChromeUpdatePipe

Keith Dixon@DetectionsAndDrums

•updated Aug 8, 2026•1•0•6

Detects creation of or connection to the \\.\Pipe\ChromeUpdatePipe named pipe used by CRAT's co-installed injector module to deliver payloads for process injection into a legitimate process.