SLEEPWALKER named-pipe C2 send/receive with embedded credentials
Detects ERAAgent.exe (ESET Remote Administrator Agent) interacting with suspicious named pipes (e.g., mojo, spoolss) and attempts to extract credentials from command line parameters, indicating potential credential dumping or lateral movement techniques using the agent process.
Microsoft Sentinel (KQL)
