Sysmon Event ID 17 — Pipe created — SecOps Tools

Why event 17 matters

Named pipes are used for C2 communication and lateral movement. Cobalt Strike uses default pipe names (msagent_*, MSSE-*-server, postex_*). Metasploit uses meterpreter-specific pipes. Custom pipes with random names may indicate C2 tools. Known malicious pipe names: \\msagent_*, \\MSSE-*-server, \\postex_ssh_*, \\postex_*.

How to detect it

Alert: PipeName matching known Cobalt Strike or Metasploit patterns. Alert: pipes created by unusual processes (cmd.exe, PowerShell). Maintain list of known C2 framework pipe name patterns.

Log source

Microsoft-Windows-Sysmon/Operational

Requires Sysmon installed with a config that logs this event (e.g. SwiftOnSecurity / Olaf Hartong).

Fields to pivot on

ImageCommandLineParentImageUserHashes

MITRE ATT&CK mapping

Tactic	Technique
Command and Control	Application Layer Protocol (T1071)
Lateral Movement	SMB/Windows Admin Shares (T1021.002)

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sigma rule

title: Suspicious Named Pipe Created — C2 Framework
status: experimental
description: Named pipe matching known C2 framework patterns
author: theadminstack.com
date: 2026/05/16
logsource:
    category: pipe_created
    product: windows
detection:
    selection:
        PipeName|contains:
            - 'msagent_'
            - 'MSSE-'
            - 'postex_'
            - 'meterpreter'
    condition: selection
falsepositives:
    - Legitimate applications with similar naming
level: high
tags:
    - attack.command_and_control
    - attack.lateral_movement

Sentinel / Defender KQL

Event
| where EventLog == "Microsoft-Windows-Sysmon/Operational" and EventID == 17   // Pipe created
// EventData holds: Image, CommandLine, ParentImage, User, Hashes
| project TimeGenerated, Computer, RenderedDescription
| sort by TimeGenerated desc

Splunk SPL

index=* sourcetype="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=17
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# Pipe created — add EventData fields: Image, CommandLine, ParentImage, User`

Hunt event 17 in Sentinel/Defender →

Build a KQL query for this event in the KQL Query Builder.

Search all event IDs →

Open the interactive Windows Event ID lookup.

Related PipeEvent events

18 Pipe connected

Frequently asked questions

What is Sysmon Event ID 17?

Pipe created. A named pipe was created. PipeName and Image are key.

Which log records event 17?

Event 17 is written to the Microsoft-Windows-Sysmon/Operational channel by Microsoft-Windows-Sysmon. Requires Sysmon installed with a config that logs this event (e.g. SwiftOnSecurity / Olaf Hartong).

What MITRE ATT&CK techniques map to event 17?

Event 17 is associated with: Application Layer Protocol (T1071), SMB/Windows Admin Shares (T1021.002).

How do you detect activity around event 17?

Alert: PipeName matching known Cobalt Strike or Metasploit patterns. Alert: pipes created by unusual processes (cmd.exe, PowerShell). Maintain list of known C2 framework pipe name patterns.