Procedure examples

Ninja can use pipes to redirect the standard input and the standard output.

When executing with non-root permissions, RotaJakiro uses the the `shmget API` to create shared memory between other known RotaJakiro processes. This allows processes to communicate with each other and share their PID.

The Havoc SMB demon can use named pipes for communication through a parent demon.

TONESHELL has facilitated inter-process communication between DLL components via the use of pipes. TONESHELL has also created a reverse shell using two anonymous pipes to write data to stdin and read data from stdout and stderr.

Medusa Ransomware has leveraged the `CreatePipe` API to enable inter-process communication.

HyperStack can connect to the IPC$ share on remote machines.

Raspberry Robin contains an embedded custom Tor network client that communicates with the primary payload via shared process memory.

Uroburos has the ability to move data between its kernel and user mode components, generally using named pipes.

OilBooster can read the results of command line execution via an unnamed pipe connected to the process.

Cyclops Blink has the ability to create a pipe to enable inter-process communication.

ROADSWEEP can pipe command output to a targeted process.

StealBit can use interprocess communication (IPC) to enable the designation of multiple files for exfiltration in a scalable manner.

SPAWNCHIMERA has leveraged IPC using a UNIX domain socket between the dsmdm process and the web process.

PITSTOP can listen over the Unix domain socket located at `/data/runtime/cockpit/wd.fd`.

LunarWeb can retrieve output from arbitrary processes and shell commands via a pipe.

Mini Shai-Hulud has executed via the use of `subprocess.run` and fed input through standard input `stdin` which acted as a pipe to send data from the parent process and the child process `sys.executable` within memory.