Three Ways to List Named Pipes in Windows
Powershell
In Windows, device driver that implements Names Pipes is actually a file system driver (NPFS.SYS). That means you can just list pipes from C# or Powershell which can use .NET calls:
[System.IO.Directory]::GetFiles("\\.\\pipe\\")
output:
\\.\\pipe\\InitShutdown
\\.\\pipe\\lsass
\\.\\pipe\\ntsvcs
\\.\\pipe\\scerpc
\\.\\pipe\\Winsock2\CatalogChangeListener-414-0
\\.\\pipe\\epmapper
\\.\\pipe\\Winsock2\CatalogChangeListener-578-0
\\.\\pipe\\Winsock2\CatalogChangeListener-1cc-0
\\.\\pipe\\Winsock2\CatalogChangeListener-5a4-0
\\.\\pipe\\LSM_API_service
\\.\\pipe\\eventlog
\\.\\pipe\\Winsock2\CatalogChangeListener-c18-0
\\.\\pipe\\atsvc
\\.\\pipe\\Winsock2\CatalogChangeListener-d70-0
\\.\\pipe\\WiFiNetworkManagerTask
\\.\\pipe\\spoolss
\\.\\pipe\\Winsock2\CatalogChangeListener-12d4-0
\\.\\pipe\\wkssvc
\\.\\pipe\\trkwks
\\.\\pipe\\srvsvc
\\.\\pipe\\Winsock2\CatalogChangeListener-2b4-0
\\.\\pipe\\NvWksServiceDdisplayPipe
...
Sysinternals PipeList
Sysinternals PipeList does similar thing if you already have it installed:
pipelist.exe
output:
PipeList v1.02 - Lists open named pipes
Copyright (C) 2005-2016 Mark Russinovich
Sysinternals - www.sysinternals.com
Pipe Name Instances Max Instances
--------- --------- -------------
InitShutdown 3 -1
lsass 4 -1
ntsvcs 3 -1
scerpc 3 -1
Winsock2\CatalogChangeListener-414-0 1 1
epmapper 3 -1
Winsock2\CatalogChangeListener-578-0 1 1
Winsock2\CatalogChangeListener-1cc-0 1 1
Winsock2\CatalogChangeListener-5a4-0 1 1
LSM_API_service 3 -1
eventlog 3 -1
Winsock2\CatalogChangeListener-c18-0 1 1
atsvc 3 -1
Winsock2\CatalogChangeListener-d70-0 1 1
WiFiNetworkManagerTask 1 -1
...
Sysinternals Process Explorer
It can also be achieved from Process Explorer. Go to Find -> Find Handle or DLL..
Search for string \Device\NamedPipe
. The advantage here is that after search is complete you can visually jump to processes and other objects offered by this great program.
To contact me, send an email anytime or leave a comment below.