PIVOTPIPE SMB Named-Pipe P2P Beacon Lateral Movement
Detects the creation of specific named pipes often associated with Cobalt Strike and similar C2 frameworks used for peer-to-peer (P2P) lateral movement. The detection looks for anomalous pipe names created by processes other than standard Windows system processes (svchost, services, lsass), which is a common indicator of beacon communication relaying.
Sigma
