Skip to content

T1559 Inter-Process Communication

Adversaries may abuse inter-process communication (IPC) mechanisms for local code or command execution. IPC is typically used by processes to share data, communicate with each other, or synchronize execution. IPC is also commonly used to avoid situations such as deadlocks, which occurs when processes are stuck in a cyclic waiting pattern.

Adversaries may abuse IPC to execute arbitrary code or commands. IPC mechanisms may differ depending on OS, but typically exists in a form accessible through programming languages/libraries or native interfaces such as Windows Dynamic Data Exchange or Component Object Model. Linux environments support several different IPC mechanisms, two of which being sockets and pipes.1 Higher level execution mediums, such as those of Command and Scripting Interpreters, may also leverage underlying IPC mechanisms. Adversaries may also use Remote Services such as Distributed Component Object Model to facilitate remote IPC execution.2

Item Value
ID T1559
Sub-techniques T1559.001, T1559.002, T1559.003
Tactics TA0002
Platforms Linux, Windows, macOS
Permissions required Administrator, SYSTEM, User
Version 1.2
Created 12 February 2020
Last Modified 11 March 2022

Procedure Examples

ID Name Description
S0687 Cyclops Blink Cyclops Blink has the ability to create a pipe to enable inter-process communication.14
S0537 HyperStack HyperStack can connect to the IPC$ share on remote machines.13

Mitigations

ID Mitigation Description
M1013 Application Developer Guidance Enable the Hardened Runtime capability when developing applications. Do not include the com.apple.security.get-task-allow entitlement with the value set to any variation of true.
M1048 Application Isolation and Sandboxing Ensure all COM alerts and Protected View are enabled.12
M1040 Behavior Prevention on Endpoint On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent DDE attacks and spawning of child processes from Office programs.34
M1042 Disable or Remove Feature or Program Registry keys specific to Microsoft Office feature control security can be set to disable automatic DDE/OLE execution. 9108 Microsoft also created, and enabled by default, Registry keys to completely disable DDE execution in Word and Excel.11
M1026 Privileged Account Management Modify Registry settings (directly or using Dcomcnfg.exe) in HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AppID_GUID} associated with the process-wide security of individual COM applications.5
M1054 Software Configuration Consider disabling embedded files in Office programs, such as OneNote, that do not work with Protected View.48

Detection

ID Data Source Data Component
DS0011 Module Module Load
DS0009 Process Process Access
DS0012 Script Script Execution

References

  1. N/A. (2021, April 1). Inter Process Communication (IPC). Retrieved March 11, 2022. ↩

  2. Hamilton, C. (2019, June 4). Hunting COM Objects. Retrieved June 10, 2019. ↩

  3. Brower, N. & D’Souza-Wiltshire, I. (2017, November 9). Enable Attack surface reduction. Retrieved February 3, 2018. ↩

  4. Nelson, M. (2018, January 29). Reviving DDE: Using OneNote and Excel for Code Execution. Retrieved February 3, 2018. ↩↩

  5. Microsoft. (n.d.). Setting Process-Wide Security Through the Registry. Retrieved November 21, 2017. ↩

  6. Microsoft. (n.d.). Registry Values for System-Wide Security. Retrieved November 21, 2017. ↩

  7. Microsoft. (n.d.). DCOM Security Enhancements in Windows XP Service Pack 2 and Windows Server 2003 Service Pack 1. Retrieved November 22, 2017. ↩

  8. Dormann, W. (2017, October 20). Disable DDEAUTO for Outlook, Word, OneNote, and Excel versions 2010, 2013, 2016. Retrieved February 3, 2018. ↩↩

  9. Microsoft. (2017, November 8). Microsoft Security Advisory 4053440 - Securely opening Microsoft Office documents that contain Dynamic Data Exchange (DDE) fields. Retrieved November 21, 2017. ↩

  10. Cimpanu, C. (2017, December 15). Microsoft Disables DDE Feature in Word to Prevent Further Malware Attacks. Retrieved December 19, 2017. ↩

  11. Microsoft. (2017, December 12). ADV170021 - Microsoft Office Defense in Depth Update. Retrieved February 3, 2018. ↩

  12. Microsoft. (n.d.). What is Protected View?. Retrieved November 22, 2017. ↩

  13. Accenture. (2020, October). Turla uses HyperStack, Carbon, and Kazuar to compromise government entity. Retrieved December 2, 2020. ↩

  14. VerSprite. (2018, January 24). Exploiting VyprVPN for MacOS. Retrieved April 20, 2022. ↩