EDR: How To Detect Named Pipes for File Creation Events

[#1]

Environment

EDR Sensor: Version 7.3.0 and Higher

Objective

How to locate named pipes for file creation events.
 

Resolution

1. In the Console -> Process Search page, search recently executed processes for 'NamedPipeServer.exe' and/or 'NamedPipeClient.exe'
2. Click on the process name and navigate to the Process Analysis page
3. Locate the filemod create event for namedpipe under the 'NamedPipeServer.exe' entry (pipe name is : \device\namedpipe\cbnamedpipe)

Additional Notes

• The 7.3.0 EDR Sensor has been updated to report named pipes for file creation events.

Related Content

• https://docs.vmware.com/en/VMware-Carbon-Black-EDR/7.3.0/rn/vmware-carbon-black-edr-windows-sensor-7...
• Reference 'Resolved Issues' in Release Notes- CB-34725: Updated sensor to report named pipes for file create events