Guide to Named Pipes and Hunting for Cobalt Strike Pipes

Intro to Named Pipes

The way that helped me start to understand pipes is to think of them as like type of network socket that is created. It can be used to send and receive information between processes or even hosts.

As a rudimentary example, you can query the current pipes on your host:

Get-ChildItem \\.\pipe\

Now lets try creating one. Below is a basic script to create a named pipe using PowerShell:

try {

$pipeName = “bad_pipe”

$pipe = New-Object system.IO.Pipes.NamedPipeServerStream($…

Read More