SOC Event Lookup
Event ID 18PipeP2

Sysmon Event ID 18: PipeEvent - Pipe Connected

Applicable version
Sysmon with this event enabled
Last reviewed
2026-07-22

Quick summary

Sysmon Event ID 18 records a named pipe connection between a client and a server.

Technical Metadata

Technical metadata for Event ID 18
Event ID18
ProviderMicrosoft-Windows-Sysmon
ChannelMicrosoft-Windows-Sysmon/Operational
LevelInformational
MITRE ATT&CKTA0002 Execution / T1559 Inter-Process Communication
Key fields to watchPipeName, Image / ProcessGuid, RuleName

Trigger Scenarios

Sysmon emits this event when a named pipe connection is made. It complements Event ID 17 by showing connection activity rather than only pipe creation.

Key Fields

PipeName

The connected named pipe. MITRE's IPC detection strategy uses anomalous named-pipe patterns, including \\.\\pipe\\svcctl, as an environment-specific detection element.

Image / ProcessGuid

Identifies the process connecting to the pipe and provides a stable join key to Sysmon Event ID 1 for command-line and parent-process context.

RuleName

Shows the Sysmon rule that matched, if rule names are configured, and helps explain why this pipe connection was captured.

Threat Hunting Queries

Microsoft Sentinel KQL: Retrieve Sysmon Event ID 18
Event
| where EventLog == "Microsoft-Windows-Sysmon/Operational" and EventID == 18
| project TimeGenerated, Computer, EventID, RenderedDescription
| order by TimeGenerated desc
Data source
Microsoft Sentinel Event table
Assumptions
The Sysmon Operational channel is collected into Event. Map raw XML fields to the documented fields.
Query reference
Splunk SPL: Retrieve Sysmon Event ID 18
index=sysmon source="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=18
| table _time, host, EventCode, Message
Data source
Splunk Windows Sysmon event data
Assumptions
Index and parsed field names vary by deployment. Add the documented event-specific conditions after field validation.
Cortex XQL: Retrieve Sysmon Event ID 18
dataset = microsoft_windows_raw
| filter edr_event_id = 18
Data source
Cortex XDR microsoft_windows_raw
Assumptions
Confirm the Sysmon provider because event IDs are not globally unique. Inspect raw fields because parsed names vary.
Query reference
Sigma rule: Sysmon Event ID 18
title: Sysmon Event ID 18
status: experimental
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 18
    condition: selection
falsepositives:
    - Legitimate administrative or system activity
level: informational
Data source
Sigma Windows Sysmon log source
Assumptions
This retrieves the event and is not a standalone malicious-behavior detection.
Query reference

Documented Values and Codes

Documented event values and their security relevance
FieldValueMeaningSecurity relevance
EventID18A process connected to a named pipe.Interpret EventID with the full event and correlated activity; this value alone is not proof of compromise. Source
PipeName\\.\pipe\nameThe connected named-pipe path used for client/server correlation.Interpret PipeName with the full event and correlated activity; this value alone is not proof of compromise. Source

MITRE ATT&CK Mapping

  • T1559Inter-Process Communication

Detection Notes

Alert when a process from C:\\Users\\, C:\\ProgramData\\, or C:\\Windows\\Temp connects to a rare named pipe or an administrative IPC pattern such as \\.\\pipe\\svcctl outside an approved administration workflow. Microsoft documents Event 18 as a named pipe connection between a client and server; MITRE DET0493 maps anomalous named-pipe creation or access to T1559 Inter-Process Communication. Correlate ProcessGuid to Event 1 and compare the Image, parent process, and host role with the named-pipe baseline.

Common False Positives

  • Approved administration, management agents, and deployment tools can generate this telemetry.
  • Baseline expected hosts, signed binaries, and change windows before suppression.

Related Events

Sample Log

Sanitized event sample
UtcTime: 2026-07-13 01:00:00.000
PipeName: \\.\\pipe\\svcctl
Image: C:\\Windows\\Temp\\client.exe
ProcessGuid: {REDACTED}
RuleName: suspicious_pipe

Frequently Asked Questions

What does Sysmon Event ID 18 mean?

A client process connected to a named pipe server.

Does Event ID 18 always indicate malicious activity?

No. Named-pipe connections are normal inter-process communication.

How should Event ID 18 be investigated?

Correlate PipeName, Image and ProcessGuid with the pipe creator and expected application behavior.

Sources

Machine-readable JSON