SOC Event Lookup
Event ID 17PipeP2

Sysmon Event ID 17: PipeEvent - Pipe Created

Applicable version
Sysmon with this event enabled
Last reviewed
2026-07-22

Quick summary

Sysmon Event ID 17 records named pipe creation.

Technical Metadata

Technical metadata for Event ID 17
Event ID17
ProviderMicrosoft-Windows-Sysmon
ChannelMicrosoft-Windows-Sysmon/Operational
LevelInformational
MITRE ATT&CKTA0002 Execution / T1559 Inter-Process Communication
Key fields to watchPipeName, Image / ProcessGuid, RuleName

Trigger Scenarios

Sysmon emits this event when a named pipe is created. Microsoft documents that malware often uses named pipes for interprocess communication.

Key Fields

PipeName

The created named pipe. MITRE's IPC detection strategy uses anomalous PipeName patterns, including examples such as \\.\\pipe\\svcctl, as an environment-specific detection element.

Image / ProcessGuid

Identifies the process that created the named pipe and provides a stable join key to Sysmon Event ID 1 for command-line and parent-process context.

RuleName

Shows the Sysmon rule that matched, if rule names are configured, and helps explain why this pipe was captured.

Threat Hunting Queries

Microsoft Sentinel KQL: Retrieve Sysmon Event ID 17
Event
| where EventLog == "Microsoft-Windows-Sysmon/Operational" and EventID == 17
| project TimeGenerated, Computer, EventID, RenderedDescription
| order by TimeGenerated desc
Data source
Microsoft Sentinel Event table
Assumptions
The Sysmon Operational channel is collected into Event. Map raw XML fields to the documented fields.
Query reference
Splunk SPL: Retrieve Sysmon Event ID 17
index=sysmon source="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=17
| table _time, host, EventCode, Message
Data source
Splunk Windows Sysmon event data
Assumptions
Index and parsed field names vary by deployment. Add the documented event-specific conditions after field validation.
Cortex XQL: Retrieve Sysmon Event ID 17
dataset = microsoft_windows_raw
| filter edr_event_id = 17
Data source
Cortex XDR microsoft_windows_raw
Assumptions
Confirm the Sysmon provider because event IDs are not globally unique. Inspect raw fields because parsed names vary.
Query reference
Sigma rule: Sysmon Event ID 17
title: Sysmon Event ID 17
status: experimental
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 17
    condition: selection
falsepositives:
    - Legitimate administrative or system activity
level: informational
Data source
Sigma Windows Sysmon log source
Assumptions
This retrieves the event and is not a standalone malicious-behavior detection.
Query reference

Documented Values and Codes

Documented event values and their security relevance
FieldValueMeaningSecurity relevance
EventID17A named pipe was created.Interpret EventID with the full event and correlated activity; this value alone is not proof of compromise. Source
PipeName\\.\pipe\nameThe named-pipe path to compare with the host and application baseline.Interpret PipeName with the full event and correlated activity; this value alone is not proof of compromise. Source

MITRE ATT&CK Mapping

  • T1559Inter-Process Communication

Detection Notes

Alert when PipeName matches a rare or high-risk environment-specific pattern such as \\.\\pipe\\svcctl and the creating Image is a user-writable path like C:\\Users\\ or C:\\ProgramData\\ rather than an approved service binary. Microsoft documents Event 17 as named pipe creation and notes that malware often uses named pipes for IPC; MITRE DET0493 explicitly calls PipeNamePattern a mutable detection element for T1559 Inter-Process Communication. Correlate ProcessGuid to Event 1 and compare the parent/child chain with the local named-pipe baseline before suppressing.

Common False Positives

  • Approved administration, management agents, and deployment tools can generate this telemetry.
  • Baseline expected hosts, signed binaries, and change windows before suppression.

Related Events

Sample Log

Sanitized event sample
UtcTime: 2026-07-13 01:00:00.000
PipeName: \\.\\pipe\\svcctl
Image: C:\\Users\\Public\\svc.exe
ProcessGuid: {REDACTED}
RuleName: suspicious_pipe

Frequently Asked Questions

What does Sysmon Event ID 17 mean?

A process created a named pipe.

Does Event ID 17 always indicate malicious activity?

No. Windows and applications use named pipes extensively for IPC.

How should Event ID 17 be investigated?

Baseline PipeName by Image and host role and join ProcessGuid to Event 1 before escalating.

Sources

Machine-readable JSON