Investigating a Windows device, you suspect a non-standard executable was launched to set up a named pipe for client-server messaging. Determine the name of the executable that was run.

DeviceEvents
| where ActionType contains "Pipe"
| distinct InitiatingProcessFileName

DeviceProcessEvents | where ActionType == 'ProcessCreated' | where FileName contains 'pipe' | project FileName, ProcessCommandLine, TimeGenerated

DeviceProcessEvents
| where ProcessCommandLine has "pipe"
| where not(FileName in~ ("svchost.exe", "lsass.exe", "services.exe", "explorer.exe", "wininit.exe", "winlogon.exe"))
| project TimeGenerated, DeviceName, FileName, FolderPath, ProcessCommandLine, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by TimeGenerated desc

DeviceProcessEvents
| where ProcessCommandLine has 'pipe'
| summarize Count=count() by FileName
| order by Count desc

let Lookback = 24h;
let NPKeywords = dynamic(["CreateNamedPipe", "NamedPipe", "Pipe"]);
(
DeviceProcessEvents
| where TimeGenerated >= ago(Lookback)
| where InitiatingProcessCommandLine has_any ("CreateNamedPipe","NamedPipe","Pipe") or ProcessCommandLine has_any ("CreateNamedPipe","NamedPipe","Pipe")
| extend ExecutableName = coalesce(InitiatingProcessFileName, FileName)
| project TimeGenerated, DeviceName, ExecutableName, InitiatingProcessCommandLine, ProcessCommandLine
)
| union (
DeviceEvents
| where TimeGenerated >= ago(Lookback)
| where InitiatingProcessCommandLine has_any ("CreateNamedPipe","NamedPipe","Pipe")
| extend ExecutableName = InitiatingProcessFileName
| project TimeGenerated, DeviceName, ExecutableName, InitiatingProcessCommandLine
)
| summarize Count = count() by ExecutableName, DeviceName
| sort by Count desc
| take 100

DeviceProcessEvents
| where InitiatingProcessCommandLine != ""
| where InitiatingProcessCommandLine contains "CreateNamedPipe" or InitiatingProcessCommandLine contains "NamedPipe" or InitiatingProcessCommandLine contains "Pipe"
| summarize Count = count(), FirstSeen = min(InitiatingProcessCreationTime), LastSeen = max(InitiatingProcessCreationTime) by ExecutableName = InitiatingProcessFileName, ExecutablePath = InitiatingProcessFolderPath
| sort by Count desc
| take 1
| project ExecutableName, ExecutablePath, Count, FirstSeen, LastSeen

DeviceProcessEvents
| where ProcessCommandLine has "pipe" or InitiatingProcessCommandLine has "pipe"
| project FileName, ProcessCommandLine, InitiatingProcessCommandLine
| distinct FileName
| order by FileName asc

DeviceProcessEvents
| where TimeGenerated >= ago(7d)
// Look for references to named pipe usage
| where tolower(ProcessCommandLine) has "pipe" or tolower(tostring(AdditionalFields)) has "namedpipe"
// Focus on executables outside standard Windows or Program Files paths
| where FileName endswith ".exe"
| where not(FolderPath startswith "C:\\Windows" or FolderPath startswith "C:\\Program Files")
| project TimeGenerated,
          DeviceId,
          DeviceName,
          ActionType,
          FolderPath,
          FileName,
          ProcessCommandLine,
          AdditionalFields
| order by TimeGenerated desc
| limit 100