Sysmon Event ID 17: PipeEvent - Pipe Created
Sysmon Event ID 17 records named pipe creation.
- Applicable version
- Sysmon with this event enabled
- Last reviewed
- 2026-07-13
Trigger Scenarios
Sysmon emits this event when a named pipe is created. Microsoft documents that malware often uses named pipes for interprocess communication.
Key Fields
PipeName
The created named pipe. MITRE's IPC detection strategy uses anomalous PipeName patterns, including examples such as \\.\\pipe\\svcctl, as an environment-specific detection element.
Image / ProcessGuid
Identifies the process that created the named pipe and provides a stable join key to Sysmon Event ID 1 for command-line and parent-process context.
RuleName
Shows the Sysmon rule that matched, if rule names are configured, and helps explain why this pipe was captured.
Common False Positives
- Approved administration, management agents, and deployment tools can generate this telemetry.
- Baseline expected hosts, signed binaries, and change windows before suppression.
Related Events
MITRE ATT&CK Mapping
- T1559Inter-Process Communication
Detection Notes
Alert when PipeName matches a rare or high-risk environment-specific pattern such as \\.\\pipe\\svcctl and the creating Image is a user-writable path like C:\\Users\\ or C:\\ProgramData\\ rather than an approved service binary. Microsoft documents Event 17 as named pipe creation and notes that malware often uses named pipes for IPC; MITRE DET0493 explicitly calls PipeNamePattern a mutable detection element for T1559 Inter-Process Communication. Correlate ProcessGuid to Event 1 and compare the parent/child chain with the local named-pipe baseline before suppressing.
Sysmon
| where EventID == 17
| project TimeGenerated, Computer, Image, ProcessGuidindex=sysmon EventCode=17 | table _time, host, Image, ProcessGuidUtcTime: 2026-07-13 01:00:00.000
PipeName: \\.\\pipe\\svcctl
Image: C:\\Users\\Public\\svc.exe
ProcessGuid: {REDACTED}
RuleName: suspicious_pipe