Detects well-known credential dumping tools execution via specific named pipe creation
Read the full analysis on IntelFusions