EDR: How To Detect Named Pipes for File Creation Events
book
Article ID: 290989
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
How to locate named pipes for file creation events.
Environment
EDR Sensor: Version 7.3.0 and Higher
Resolution
- In the Console -> Process Search page, search recently executed processes for 'NamedPipeServer.exe' and/or 'NamedPipeClient.exe'
- Click on the process name and navigate to the Process Analysis page
- Locate the filemod create event for namedpipe under the 'NamedPipeServer.exe' entry (pipe name is : \device\namedpipe\cbnamedpipe)
Additional Information
- The 7.3.0 EDR Sensor has been updated to report named pipes for file creation events.
Feedback
thumb_up
Yes
thumb_down
No