Communication with Processes

Check all TCP / UDP connections

netstat -ano

Use the tool Pipelist from the Sysinternals Suite to enumerate instances of named pipes

pipelist.exe /accepteula

List named pipes with powershell

gci \\.\pipe\

Use Accesschk to enumerate the permissions (DACL) assigned to a specific named pipe

.\accesschk.exe /accepteula \pipe\

Review DACL of lsass process

accesschk.exe /accepteula \\.\Pipe\lsass -v