Log an event when a comport is opened in windows 10

How could I diagnose what executable is using a comport (it connects to ntoskrnl.exe via a named pipe in a VM).