Log Dejargonizer

Sysmon · Event 18

Sysmon Event 18: A process connected to a named pipe

A process attached to a pipe another process was hosting. Paired with Event 17 it shows both ends of the conversation — which is how you tell what actually talked to a suspicious pipe rather than just that one existed.

Also written as Sysmon 18Sysmon Event ID 18Pipe Connectednamed pipe connected sysmon

What it means for you

For an analyst

Event 17 tells you a pipe was created; 18 tells you what connected. For privilege escalation via impersonation, the connecting process is often the more interesting of the two, because that is the process about to receive a token it should not have.

What it looks like

Sanitised. Addresses come from the RFC 5737 documentation ranges.

Sample
Pipe Connected:
  RuleName: -
  EventType: ConnectPipe
  UtcTime: 2026-08-28 09:15:20.114
  ProcessGuid: {a1b2c3d4-0000-0000-0000-0000000012ef}
  ProcessId: 812
  PipeName: \a1b2c3d4e5
  Image: C:\Windows\System32\services.exe
  User: NT AUTHORITY\SYSTEM

The fields that decide it

Everything else in the log line is context.

PipeName
The pipe that was connected to. Match against the Event 17 that created it.
Image
The process that connected. For impersonation attacks this is frequently the interesting end.
ProcessGuid
Join on this for the connecting process's command line and parent.
User
The account the connecting process runs under.

Ordinary reasons this happens

Most of the time it is one of these.

  • Windows components communicating internally, which is nearly all of the volume.
  • Service control and remote procedure calls.
  • Applications talking to their own helper processes.
  • Management and security agents.

When it is not ordinary

Privilege escalation through pipe impersonation.

What gives it awayA privileged process connecting to a pipe hosted by an unprivileged one, shortly before a process appears running as SYSTEM.

ATT&CK T1134.002

Post-exploitation framework traffic.

What gives it awayA connection to a pipe hosted by a binary in a temp or user-writable directory.

ATT&CK T1071

Lateral movement over SMB.

What gives it awayPipe connections arriving on a remote host, alongside IPC$ access in Event 5145.

ATT&CK T1021.002

What to do next

  1. Find the matching Event 17 to see which process hosted the pipe.
  2. Compare the two processes. An unprivileged host with a privileged connector is the impersonation shape.
  3. Join on ProcessGuid for both ends to get command lines and parents.
  4. Check whether either binary runs from a user-writable directory.
  5. Correlate with Sysmon Event 1 for anything appearing as SYSTEM shortly afterwards.

Queries to run

kql Both ends of pipes involving user-writable directories. 
Event | where Source == 'Microsoft-Windows-Sysmon' and EventID in (17, 18) | where Image has_any ('\\Temp\\','\\AppData\\') | project TimeGenerated, Computer, EventID, Image, PipeName | order by TimeGenerated asc
kql Rare pipe and process combinations. 
Event | where Source == 'Microsoft-Windows-Sysmon' and EventID == 18 | summarize hosts = dcount(Computer) by PipeName, Image | where hosts <= 2

Common questions

What is the difference between Sysmon Event 17 and 18?

17 records a pipe being created — one process opening a channel. 18 records something connecting to it. Together they show both ends, which is what you need to understand pipe-based privilege escalation, where an unprivileged process hosts a pipe and waits for a privileged one to connect.

How does named pipe impersonation work?

An unprivileged process creates a pipe and persuades a privileged process to connect to it. Once connected, the pipe's owner can impersonate the connecting process's security context. The pattern in the logs is an Event 17 from a low-privilege process followed by an Event 18 from a high-privilege one, and then something new appearing as SYSTEM.

Read next

Vendor documentation

Last reviewed 28 August 2026