Windows PUA Named Pipe — Detection Rule
The following analytic detects the creation or connection to named pipes used by potentially unwanted applications (PUAs) like VPNs or utilities like PsExec. It leverages Sysmon EventCodes 17 and 18. If confirmed malicious, this could allow an attacker to abuse these to potentially gain persistence, command and control, or further system compromise.