EDR: How To Detect Named Pipes for File Creation Events

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

How to locate named pipes for file creation events.
 

Environment

EDR Sensor: Version 7.3.0 and Higher

Resolution

1. In the Console -> Process Search page, search recently executed processes for 'NamedPipeServer.exe' and/or 'NamedPipeClient.exe'
2. Click on the process name and navigate to the Process Analysis page
3. Locate the filemod create event for namedpipe under the 'NamedPipeServer.exe' entry (pipe name is : \device\namedpipe\cbnamedpipe)

Additional Information

• The 7.3.0 EDR Sensor has been updated to report named pipes for file creation events.