Three Ways to List Named Pipes in Windows

Powershell

In Windows, device driver that implements Names Pipes is actually a file system driver (NPFS.SYS). That means you can just list pipes from C# or Powershell which can use .NET calls:

[System.IO.Directory]::GetFiles("\\.\\pipe\\")

output:

\\.\\pipe\\InitShutdown
\\.\\pipe\\lsass
\\.\\pipe\\ntsvcs
\\.\\pipe\\scerpc
\\.\\pipe\\Winsock2\CatalogChangeListener-414-0
\\.\\pipe\\epmapper
\\.\\pipe\\Winsock2\CatalogChangeListener-578-0
\\.\\pipe\\Winsock2\CatalogChangeListener-1cc-0
\\.\\pipe\\Winsock2\CatalogChangeListener-5a4-0
\\.\\pipe\\LSM_API_service
\\.\\pipe\\eventlog
\\.\\pipe\\Winsock2\CatalogChangeListener-c18-0
\\.\\pipe\\atsvc
\\.\\pipe\\Winsock2\CatalogChangeListener-d70-0
\\.\\pipe\\WiFiNetworkManagerTask
\\.\\pipe\\spoolss
\\.\\pipe\\Winsock2\CatalogChangeListener-12d4-0
\\.\\pipe\\wkssvc
\\.\\pipe\\trkwks
\\.\\pipe\\srvsvc
\\.\\pipe\\Winsock2\CatalogChangeListener-2b4-0
\\.\\pipe\\NvWksServiceDdisplayPipe
...

Sysinternals PipeList

Sysinternals PipeList does similar thing if you already have it installed:

pipelist.exe

output:

PipeList v1.02 - Lists open named pipes
Copyright (C) 2005-2016 Mark Russinovich
Sysinternals - www.sysinternals.com

Pipe Name                                    Instances       Max Instances
---------                                    ---------       -------------
InitShutdown                                      3               -1
lsass                                             4               -1
ntsvcs                                            3               -1
scerpc                                            3               -1
Winsock2\CatalogChangeListener-414-0              1                1
epmapper                                          3               -1
Winsock2\CatalogChangeListener-578-0              1                1
Winsock2\CatalogChangeListener-1cc-0              1                1
Winsock2\CatalogChangeListener-5a4-0              1                1
LSM_API_service                                   3               -1
eventlog                                          3               -1
Winsock2\CatalogChangeListener-c18-0              1                1
atsvc                                             3               -1
Winsock2\CatalogChangeListener-d70-0              1                1
WiFiNetworkManagerTask                            1               -1
...

Sysinternals Process Explorer

It can also be achieved from Process Explorer. Go to Find -> Find Handle or DLL..

image-20220928093117681

Search for string \Device\NamedPipe. The advantage here is that after search is complete you can visually jump to processes and other objects offered by this great program.

image-20220928093314087


To contact me, send an email anytime or leave a comment below.