Suspicious SMB Named Pipe

A named pipe is a process that enables peer-to-peer communication over the SMB file sharing protocol. Typically, read and write file operations are sent over pipes. Attackers can communicate commands and share data between compromised devices over a chain of linked pipes that hide the malicious activity. The chain can eventually lead to a device with an external connection to a C&C server. There are several tools that help attackers establish named pipes. If an attacker does not change the default name provided by the attack tool or malware, the named pipe will have a recognizable name that can indicate malicious activity.