SMB Named Pipe Beaconing

SMB named pipes can help an attacker relay messages between multiple compromised devices on a network. A named pipe is a file that enables peer-to-peer communication by storing command output. An attacker can send a command between two compromised devices, but the attacker does not know how long it will take for the command to run. The pipe peek beacon checks to see if there is output available and alerts the attacker when there is command output that is ready to be read. A named pipe beacon does not confirm that an attacker has established a beacon to an external C&C server, but it does match activity that is associated with attack toolkits such as Cobalt Strike, which is often associated with malicious activity. A chain of compromised devices linked by named pipes can help the attacker move closer to their objective, such as gaining access to high-value assets and exfiltrating data.

Legitimate processes such as MSSQL will check the contents of a named pipe during communication with a client. However, a consistent pattern of checks on a new named pipe can indicate malicious beaconing activity.