CmdID

CmdID / Commands

mkfifo

Create FIFOs (named pipes). toybox

On Linux 2 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Linux

from the toybox, 0BSD

Create FIFOs (named pipes). ! !-Z Security context

mkfifo ![!-!Z! !C!O!N!T!E!X!T!]! [NAME...]

Several platforms

from tldr-pages, CC BY 4.0

Make named pipes, also known as First In First Out (FIFO).

Create a named pipe at a given path

mkfifo path/to/pipeIdentify

Trips 1 Sigma rule: lowNamed Pipe Created Via Mkfifo by Nasreddine Bencherchali (Nextron Systems)

Send data through a named pipe and send the command to the background

echo "Hello World" >path/to/pipe &Identify

Receive data through a named pipe

cat path/to/pipeIdentify

Share your terminal session in real-time

mkfifo path/to/pipe; script --flush path/to/pipeIdentify

Trips 1 Sigma rule: lowNamed Pipe Created Via Mkfifo by Nasreddine Bencherchali (Nextron Systems)

What detects it

Sigma process creation rules that name mkfifo
mediumPotentially Suspicious Named Pipe Created Via MkfifoNasreddine Bencherchali (Nextron Systems)
lowNamed Pipe Created Via MkfifoNasreddine Bencherchali (Nextron Systems)