Detects anomalous use of COM, DDE, or named pipes for execution. Correlates creation or access of IPC mechanisms (e.g., named pipes, COM objects) with unusual parent-child process relationships or code injection patterns (e.g., Office spawning cmd.exe via DDE).
| Data Component | Name | Channel |
|---|---|---|
| Process Access (DC0035) | WinEventLog:Security | EventCode=4656 |
| Named Pipe Metadata (DC0048) | WinEventLog:Sysmon | EventCode=17 |
| Field | Description |
|---|---|
| PipeNamePattern | Environment-specific pipe names used legitimately vs anomalous (e.g., \\.\pipe\svcctl). |
| AllowedParentChildPairs | Expected parent-child process lineage to minimize false positives (e.g., explorer.exe spawning outlook.exe). |
Detects abuse of UNIX domain sockets, pipes, or message queues for unauthorized code execution. Correlates unexpected socket creation with suspicious binaries, abnormal shell pipelines, or injected processes establishing IPC channels.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | auditd:SYSCALL | socket: Suspicious creation of AF_UNIX sockets outside expected daemons |
| File Access (DC0055) | auditd:SYSCALL | open: Access to named pipes or FIFO in /tmp or /dev/shm by unexpected processes |
| Field | Description |
|---|---|
| SocketPathBaseline | Expected UNIX socket paths used by system services and applications. |
| FIFOAccessPatterns | Legitimate processes expected to open pipes in shared directories. |
Detects anomalous use of Mach ports, Apple Events, or XPC services for inter-process execution or code injection. Focuses on unexpected processes attempting to send privileged Apple Events (e.g., automation scripts injecting into security-sensitive apps).
| Data Component | Name | Channel |
|---|---|---|
| Process Access (DC0035) | macos:unifiedlog | Unusual Mach port registration or access attempts between unrelated processes |
| Script Execution (DC0029) | macos:osquery | exec: Unexpected execution of osascript or AppleScript targeting sensitive apps |
| Field | Description |
|---|---|
| AllowedAppleEventTargets | Whitelisted app-to-app Apple Event communications (e.g., Finder automation). |
| MachPortBaseline | Baseline of Mach ports and XPC services normally used in the environment. |