connect-pipe.yml

rule:
  meta:
    name: connect pipe
    namespace: communication/named-pipe/connect
    author:
      - moritz.raabe@fireeye.com
      - michael.hunhoff@fireeye.com
    scope: function
    mbc:
      - Communication::Interprocess Communication::Connect Pipe [C0003.002]
    examples:
      # Windows msdt.exe
      - 152d4c9f63efb332ccb134c6953c0104:0x42e400
  features:
    - or:
      - api: kernel32.ConnectNamedPipe
      - api: kernel32.CallNamedPipe  # connects, writes, and reads from pipe in single operation