Elevated Python process creating named pipe C2 server (SLEEPWALKER 0x7E)

Arnold Chan@slaz

•updated Sep 7, 2026•0•0•0

Detects Python processes (python.exe, pythonw.exe, py.exe) executing with high or system integrity levels and interacting with named pipes, a technique often used for inter-process communication, persistence, or process injection.