Named pipes aliases: introduction

• Windows named pipes are implemented by a file system driver

  • npfs.sys : named pipe file system driver

• Named pipes file system related tools (Sysinternals)

  • pipelist: named pipes enumeration
  • filemon: file systems activity, including npfs
  • pipeacl: named pipes security descriptor viewer

• The npfs driver supports aliases

  • Alias names stored in the registry
    • HKLM\SYSTEM\CurrentControlSet\Services\Npfs\Aliases\ key
    • Two values : lsass and ntsvcs
  • Some named pipes do not exist in the npfs namespace but are aliases of either lsass or ntsvcs