Question Analysis

DeviceEvents | where ActionType contains "Pipe" | distinct InitiatingProcessFileName

DeviceProcessEvents | where ActionType == 'ProcessCreated' | where FileName contains 'pipe' | project FileName, ProcessCommandLine, TimeGenerated

DeviceProcessEvents | where ProcessCommandLine has "pipe" | where not(FileName in~ ("svchost.exe", "lsass.exe", "services.exe", "explorer.exe", "wininit.exe", "winlogon.exe")) | project TimeGenerated, DeviceName, FileName, FolderPath, ProcessCommandLine, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine | order by TimeGenerated desc

DeviceProcessEvents | where ProcessCommandLine has 'pipe' | summarize Count=count() by FileName | order by Count desc

let Lookback = 24h; let NPKeywords = dynamic(["CreateNamedPipe", "NamedPipe", "Pipe"]); ( DeviceProcessEvents | where TimeGenerated >= ago(Lookback) | where InitiatingProcessCommandLine has_any ("CreateNamedPipe","NamedPipe","Pipe") or ProcessCommandLine has_any ("CreateNamedPipe","NamedPipe","Pipe") | extend ExecutableName = coalesce(InitiatingProcessFileName, FileName) | project TimeGenerated, DeviceName, ExecutableName, InitiatingProcessCommandLine, ProcessCommandLine ) | union ( DeviceEvents | where TimeGenerated >= ago(Lookback) | where InitiatingProcessCommandLine has_any ("CreateNamedPipe","NamedPipe","Pipe") | extend ExecutableName = InitiatingProcessFileName | project TimeGenerated, DeviceName, ExecutableName, InitiatingProcessCommandLine ) | summarize Count = count() by ExecutableName, DeviceName | sort by Count desc | take 100

DeviceProcessEvents | where InitiatingProcessCommandLine != "" | where InitiatingProcessCommandLine contains "CreateNamedPipe" or InitiatingProcessCommandLine contains "NamedPipe" or InitiatingProcessCommandLine contains "Pipe" | summarize Count = count(), FirstSeen = min(InitiatingProcessCreationTime), LastSeen = max(InitiatingProcessCreationTime) by ExecutableName = InitiatingProcessFileName, ExecutablePath = InitiatingProcessFolderPath | sort by Count desc | take 1 | project ExecutableName, ExecutablePath, Count, FirstSeen, LastSeen

DeviceProcessEvents | where ProcessCommandLine has "pipe" or InitiatingProcessCommandLine has "pipe" | project FileName, ProcessCommandLine, InitiatingProcessCommandLine | distinct FileName | order by FileName asc

DeviceProcessEvents | where TimeGenerated >= ago(7d) // Look for references to named pipe usage | where tolower(ProcessCommandLine) has "pipe" or tolower(tostring(AdditionalFields)) has "namedpipe" // Focus on executables outside standard Windows or Program Files paths | where FileName endswith ".exe" | where not(FolderPath startswith "C:\\Windows" or FolderPath startswith "C:\\Program Files") | project TimeGenerated, DeviceId, DeviceName, ActionType, FolderPath, FileName, ProcessCommandLine, AdditionalFields | order by TimeGenerated desc | limit 100