HackTool - Koh Default Named Pipe (0adc67e0-a68f-4ffd-9c43-28905aad5d6a)

Detects creation of default named pipes used by the Koh tool

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
HackTool - Koh Default Named Pipe (0adc67e0-a68f-4ffd-9c43-28905aad5d6a)	Sigma-Rules	Steal Application Access Token - T1528 (890c9858-598c-401d-a4d5-c67ebcdd703a)	Attack Pattern	1
HackTool - Koh Default Named Pipe (0adc67e0-a68f-4ffd-9c43-28905aad5d6a)	Sigma-Rules	Token Impersonation/Theft - T1134.001 (86850eff-2729-40c3-b85e-c4af26da4a2d)	Attack Pattern	1
Access Token Manipulation - T1134 (dcaa092b-7de9-4a21-977f-7fcb77e89c48)	Attack Pattern	Token Impersonation/Theft - T1134.001 (86850eff-2729-40c3-b85e-c4af26da4a2d)	Attack Pattern	2