#ParsedReport #CompletenessMedium
15-09-2026

PIVOTPIPE: A New Unofficial .NET-Based Beacon Payload

https://sect.iij.ad.jp/blog/2026/09/pivotpipe/

Report completeness: Medium

Threats:
Pivotpipe
Cobalt_strike_tool
Amsi_bypass_technique
Smb_beacon_tool

ChatGPT TTPs:
do not use without manual check
T1027, T1027.013, T1090.001, T1095, T1105, T1140, T1562.001

IOCs:
File: 17
IP: 1
Hash: 3

Soft:
Twitter

Algorithms:
gzip, xor

Win API:
AmsiScanBuffer, RevertToSelf

Languages:
python

Platforms:
x64

YARA: Found

Links:
https://github.com/mopisec/research/blob/main/unpack\_pivotpipe\_datablob.py