Log Dejargonizer

Sysmon · Event 17

Sysmon Event 17: A named pipe was created

A process opened a named pipe — a channel other processes can connect to. Windows uses them constantly for legitimate work, but offensive tooling relies on them too, and several frameworks leave recognisable pipe names behind.

Also written as Sysmon 17Sysmon Event ID 17Pipe Creatednamed pipe created sysmon

What it means for you

On a personal computer

Only present if you installed Sysmon. Named pipes are an ordinary part of how Windows programs talk to each other.

For an analyst

Two things make pipes useful. Post-exploitation frameworks use them for internal communication and for privilege escalation via impersonation, and default pipe names are published for most well-known tooling. Even randomised names often keep a recognisable structure. Filter to the creating process rather than trying to enumerate every bad name — a shell or a binary in a temp directory creating a pipe is interesting regardless of what it is called.

What it looks like

Sanitised. Addresses come from the RFC 5737 documentation ranges.

Sample
Pipe Created:
  RuleName: -
  EventType: CreatePipe
  UtcTime: 2026-08-28 09:15:19.882
  ProcessGuid: {a1b2c3d4-0000-0000-0000-00000000abcd}
  ProcessId: 7412
  PipeName: \a1b2c3d4e5
  Image: C:\Users\jbrooks\AppData\Local\Temp\wh.exe
  User: CORP\jbrooks

The fields that decide it

Everything else in the log line is context.

PipeName
The name of the pipe. Public research documents defaults for most well-known tooling.
  • A name matching a known offensive framework defaultDocumented and worth alerting on, though defaults are easily changed.
  • A short random-looking hexadecimal stringCommon for tooling that randomises pipe names.
  • A recognisable Windows pipe nameOrdinary system operation, and most of the volume.
Image
The process that created the pipe. This matters more than the name.
  • A binary in a temp or user profile directoryPrograms there rarely have a legitimate reason to host a pipe.
  • A shell or scripting engineWorth reading.
ProcessGuid
Join on this for the creating process's command line and parent.

Ordinary reasons this happens

Most of the time it is one of these.

  • Windows components communicating internally, which is nearly all of the volume.
  • Remote procedure calls and service control.
  • Applications with helper processes, including browsers and office software.
  • Management and security agents.
  • Database and virtualisation software.

When it is not ordinary

Post-exploitation framework communication.

What gives it awayA pipe created by a process running from a user-writable directory, or by a shell, particularly with a name matching published tooling defaults.

ATT&CK T1071

Privilege escalation through pipe impersonation.

What gives it awayA pipe created shortly before a process appears running as SYSTEM, from a session that was not previously privileged.

ATT&CK T1134.002

Lateral movement over SMB.

What gives it awayPipe creation on a remote host, visible alongside IPC$ access in Event 5145.

ATT&CK T1021.002

What to do next

  1. Read the creating process before the pipe name. The process is the more durable signal.
  2. Join on ProcessGuid to Sysmon Event 1 for the command line and parent.
  3. Check whether the same pipe name appears across many machines. Your own software will be consistent.
  4. For a suspected framework pipe, look for a matching Event 18 showing what connected to it.
  5. Correlate with Sysmon Event 3 — tooling that hosts a pipe usually talks to the network too.

Queries to run

kql Pipes hosted by processes in user-writable directories. Far more reliable than chasing pipe names. 
Event | where Source == 'Microsoft-Windows-Sysmon' and EventID == 17 | where Image has_any ('\\Temp\\','\\AppData\\','\\Users\\Public\\') | project TimeGenerated, Computer, Image, PipeName, User
kql Pipe names appearing on very few machines. Normal system pipes are everywhere. 
Event | where Source == 'Microsoft-Windows-Sysmon' and EventID == 17 | summarize hosts = dcount(Computer) by PipeName | where hosts <= 2 | order by PipeName asc

Common questions

What is a named pipe?

A channel one process creates so others can connect and exchange data, identified by a name rather than a network address. Windows uses them heavily for internal communication and for remote administration over SMB. They are entirely normal — which is exactly why offensive tooling uses them too.

Is detecting known pipe names a reliable detection?

It is worth having and easy to bypass. Published default names for well-known frameworks are trivially changed by anyone who reads the documentation. Detection built on which process is hosting the pipe holds up much better, because a binary in a temp directory hosting a pipe is unusual whatever it calls itself.

Should I enable Sysmon pipe logging?

Yes, but filter it. Unfiltered it is high volume because Windows creates pipes constantly. Scope it to processes outside normal program directories and to the pipe names your threat intelligence actually covers, and it becomes manageable while keeping the useful part.

Read next

Vendor documentation

Last reviewed 28 August 2026