Sysmon Event ID 18 — Pipe connected — SecOps Tools

Why event 18 matters

Same context as Sysmon 17. Client-side of named pipe connections for C2 lateral movement. SMB-based lateral movement tools connect to named pipes on remote hosts.

How to detect it

Alert: connections to known C2 pipe names. Alert: unexpected processes connecting to admin pipe names.

Log source

Microsoft-Windows-Sysmon/Operational

Requires Sysmon installed with a config that logs this event (e.g. SwiftOnSecurity / Olaf Hartong).

Fields to pivot on

ImageCommandLineParentImageUserHashes

MITRE ATT&CK mapping

Tactic	Technique
Command and Control	Application Layer Protocol (T1071)

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sentinel / Defender KQL

Event
| where EventLog == "Microsoft-Windows-Sysmon/Operational" and EventID == 18   // Pipe connected
// EventData holds: Image, CommandLine, ParentImage, User, Hashes
| project TimeGenerated, Computer, RenderedDescription
| sort by TimeGenerated desc

Splunk SPL

index=* sourcetype="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=18
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# Pipe connected — add EventData fields: Image, CommandLine, ParentImage, User`

Hunt event 18 in Sentinel/Defender →

Build a KQL query for this event in the KQL Query Builder.

Search all event IDs →

Open the interactive Windows Event ID lookup.

Related PipeEvent events

17 Pipe created

Frequently asked questions

What is Sysmon Event ID 18?

Pipe connected. A client connected to a named pipe. PipeName and Image are key.

Which log records event 18?

Event 18 is written to the Microsoft-Windows-Sysmon/Operational channel by Microsoft-Windows-Sysmon. Requires Sysmon installed with a config that logs this event (e.g. SwiftOnSecurity / Olaf Hartong).

What MITRE ATT&CK techniques map to event 18?

Event 18 is associated with: Application Layer Protocol (T1071).

How do you detect activity around event 18?

Alert: connections to known C2 pipe names. Alert: unexpected processes connecting to admin pipe names.