Sysmon Event ID 18: PipeEvent - Pipe Connected
Sysmon Event ID 18 records a named pipe connection between a client and a server.
- Applicable version
- Sysmon with this event enabled
- Last reviewed
- 2026-07-13
Trigger Scenarios
Sysmon emits this event when a named pipe connection is made. It complements Event ID 17 by showing connection activity rather than only pipe creation.
Key Fields
PipeName
The connected named pipe. MITRE's IPC detection strategy uses anomalous named-pipe patterns, including \\.\\pipe\\svcctl, as an environment-specific detection element.
Image / ProcessGuid
Identifies the process connecting to the pipe and provides a stable join key to Sysmon Event ID 1 for command-line and parent-process context.
RuleName
Shows the Sysmon rule that matched, if rule names are configured, and helps explain why this pipe connection was captured.
Common False Positives
- Approved administration, management agents, and deployment tools can generate this telemetry.
- Baseline expected hosts, signed binaries, and change windows before suppression.
Related Events
MITRE ATT&CK Mapping
- T1559Inter-Process Communication
Detection Notes
Alert when a process from C:\\Users\\, C:\\ProgramData\\, or C:\\Windows\\Temp connects to a rare named pipe or an administrative IPC pattern such as \\.\\pipe\\svcctl outside an approved administration workflow. Microsoft documents Event 18 as a named pipe connection between a client and server; MITRE DET0493 maps anomalous named-pipe creation or access to T1559 Inter-Process Communication. Correlate ProcessGuid to Event 1 and compare the Image, parent process, and host role with the named-pipe baseline.
Sysmon
| where EventID == 18
| project TimeGenerated, Computer, Image, ProcessGuidindex=sysmon EventCode=18 | table _time, host, Image, ProcessGuidUtcTime: 2026-07-13 01:00:00.000
PipeName: \\.\\pipe\\svcctl
Image: C:\\Windows\\Temp\\client.exe
ProcessGuid: {REDACTED}
RuleName: suspicious_pipe