SMB named pipes are Windows communication endpoints that ride over the Server Message Block file-sharing protocol. They let processes exchange data through pipe names such as \\.\pipe\... on a local host or across the network through an SMB session. In practice, they are a form of inter-process communication that can be used by legitimate services, management tools, and remote administration components.
They matter in cyber security because attackers can abuse named pipes to hide command traffic inside ordinary Windows file-sharing behavior. Malware may use them for local privilege escalation, remote tasking, lateral movement, or to avoid obvious outbound connections. Defenders look for unusual pipe names, unexpected SMB connections, and suspicious process-to-pipe access patterns. Good telemetry includes Windows object access logs, Sysmon pipe events, and correlation with the process that created or opened the pipe.