Suppose a system administrator became aware of a service running on their server that both created a named pipe that allowed access by remote clients (e.g., ordinary domain users), and that had an exploitable vulnerability that could be triggered over that named pipe.

In this situation, the administrator may want to either prevent any remote clients from gaining access to that specific named pipe, or do audit logging of any users attempting to open that named pipe.

How could that administrator accomplish those goals?

Assume that the vulnerable service is a third-party binary, and the administrator cannot change it. Also assume that users must be able to access other named pipes on this system besides the vulnerable one. Ideally, a solution would involve configurable option(s) within Windows, but third party products that can provide a solution would suffice.

  • If you're willing to log everything and the kitchen sink, Local Security Policy > Advanced Audit Policy Configuration > System Audit Policies > Object Access > Audit Detailed File Share will produce Event ID 5145 in the Security Event Log, and the name of the pipe will be shown under "Relative Target Name" in the details. But you'll be logging EVERY remote file/pipe access. – hantwister Mar 16 '18 at 16:36
  • A concrete example of a vulnerability where this question would apply is CVE-2018-1234. – hantwister May 8 '18 at 0:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.