{
  "id": "18",
  "source": "sysmon",
  "category": "Pipe",
  "name": "PipeEvent - Pipe Connected",
  "priority": "P2",
  "applicable_version": "Sysmon with this event enabled",
  "last_reviewed": "2026-07-13",
  "definition": "Sysmon Event ID 18 records a named pipe connection between a client and a server.",
  "trigger_scenarios": "Sysmon emits this event when a named pipe connection is made. It complements Event ID 17 by showing connection activity rather than only pipe creation.",
  "key_fields": [
    {
      "field": "PipeName",
      "explanation": "The connected named pipe. MITRE's IPC detection strategy uses anomalous named-pipe patterns, including \\\\.\\\\pipe\\\\svcctl, as an environment-specific detection element."
    },
    {
      "field": "Image / ProcessGuid",
      "explanation": "Identifies the process connecting to the pipe and provides a stable join key to Sysmon Event ID 1 for command-line and parent-process context."
    },
    {
      "field": "RuleName",
      "explanation": "Shows the Sysmon rule that matched, if rule names are configured, and helps explain why this pipe connection was captured."
    }
  ],
  "false_positives": [
    "Approved administration, management agents, and deployment tools can generate this telemetry.",
    "Baseline expected hosts, signed binaries, and change windows before suppression."
  ],
  "related_event_ids": [
    "1"
  ],
  "attck_mapping": [
    {
      "technique_id": "T1559",
      "technique_name": "Inter-Process Communication"
    }
  ],
  "detection_notes": "Alert when a process from C:\\\\Users\\\\, C:\\\\ProgramData\\\\, or C:\\\\Windows\\\\Temp connects to a rare named pipe or an administrative IPC pattern such as \\\\.\\\\pipe\\\\svcctl outside an approved administration workflow. Microsoft documents Event 18 as a named pipe connection between a client and server; MITRE DET0493 maps anomalous named-pipe creation or access to T1559 Inter-Process Communication. Correlate ProcessGuid to Event 1 and compare the Image, parent process, and host role with the named-pipe baseline.",
  "kql_snippet": "Sysmon\n| where EventID == 18\n| project TimeGenerated, Computer, Image, ProcessGuid",
  "spl_snippet": "index=sysmon EventCode=18 | table _time, host, Image, ProcessGuid",
  "sample_log": "UtcTime: 2026-07-13 01:00:00.000\nPipeName: \\\\.\\\\pipe\\\\svcctl\nImage: C:\\\\Windows\\\\Temp\\\\client.exe\nProcessGuid: {REDACTED}\nRuleName: suspicious_pipe",
  "source_url": "https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon",
  "route": "/sysmon-events/18/",
  "canonical_url": "https://soceventlookup.com/sysmon-events/18/",
  "json_url": "/api/events/sysmon/18.json"
}