1. Home
  2. Techniques
  3. Enterprise
  4. Inter-Process Communication

Inter-Process Communication

ID Name
T1559.001 Component Object Model
T1559.002 Dynamic Data Exchange
T1559.003 XPC Services

Adversaries may abuse inter-process communication (IPC) mechanisms for local code or command execution. IPC is typically used by processes to share data, communicate with each other, or synchronize execution. IPC is also commonly used to avoid situations such as deadlocks, which occurs when processes are stuck in a cyclic waiting pattern.

Adversaries may abuse IPC to execute arbitrary code or commands. IPC mechanisms may differ depending on OS, but typically exists in a form accessible through programming languages/libraries or native interfaces such as Windows Dynamic Data Exchange or Component Object Model. Linux environments support several different IPC mechanisms, two of which being sockets and pipes.[1] Higher level execution mediums, such as those of Command and Scripting Interpreters, may also leverage underlying IPC mechanisms. Adversaries may also use Remote Services such as Distributed Component Object Model to facilitate remote IPC execution.[2]

ID: T1559
Sub-techniques:  T1559.001, T1559.002, T1559.003
ⓘ
Tactic: Execution
ⓘ
Platforms: Linux, Windows, macOS
Version: 1.4
Created: 12 February 2020
Last Modified: 15 April 2025
Version Permalink

Procedure Examples

ID Name Description
S0687 Cyclops Blink

Cyclops Blink has the ability to create a pipe to enable inter-process communication.[3]
S0537 HyperStack

HyperStack can connect to the IPC$ share on remote machines.[4]
S1141 LunarWeb

LunarWeb can retrieve output from arbitrary processes and shell commands via a pipe.[5]
S1100 Ninja

Ninja can use pipes to redirect the standard input and the standard output.[6]
S1172 OilBooster

OilBooster can read the results of command line execution via an unnamed pipe connected to the process.[7]
C0048 Operation MidnightEclipse

During Operation MidnightEclipse, threat actors wrote output to stdout then piped it to bash for execution.[8]
S1123 PITSTOP

PITSTOP can listen over the Unix domain socket located at /data/runtime/cockpit/wd.fd.[9]
S1130 Raspberry Robin

Raspberry Robin contains an embedded custom Tor network client that communicates with the primary payload via shared process memory.[10]
S1150 ROADSWEEP

ROADSWEEP can pipe command output to a targeted process.[11]
S1078 RotaJakiro

When executing with non-root permissions, RotaJakiro uses the the shmget API to create shared memory between other known RotaJakiro processes. This allows processes to communicate with each other and share their PID.[12]
S1200 StealBit

StealBit can use interprocess communication (IPC) to enable the designation of multiple files for exfiltration in a scalable manner.[13]
S0022 Uroburos

Uroburos has the ability to move data between its kernel and user mode components, generally using named pipes.[14]

Mitigations

ID Mitigation Description
M1013 Application Developer Guidance

Enable the Hardened Runtime capability when developing applications. Do not include the com.apple.security.get-task-allow entitlement with the value set to any variation of true.

M1048 Application Isolation and Sandboxing

Ensure all COM alerts and Protected View are enabled.[15]
M1040 Behavior Prevention on Endpoint

On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent DDE attacks and spawning of child processes from Office programs.[16][17]
M1042 Disable or Remove Feature or Program

Registry keys specific to Microsoft Office feature control security can be set to disable automatic DDE/OLE execution. [18][19][20] Microsoft also created, and enabled by default, Registry keys to completely disable DDE execution in Word and Excel.[21]
M1026 Privileged Account Management

Modify Registry settings (directly or using Dcomcnfg.exe) in HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AppID_GUID} associated with the process-wide security of individual COM applications.[22]

Modify Registry settings (directly or using Dcomcnfg.exe) in HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole associated with system-wide security defaults for all COM applications that do no set their own process-wide security.[23] [24]
M1054 Software Configuration

Consider disabling embedded files in Office programs, such as OneNote, that do not work with Protected View.[17][20]

Detection

ID Data Source Data Component Detects
DS0011 Module Module Load

Monitor for the loading of unusual modules or DLLs into processes. Specifically focus on modules that are not typically loaded or associated with IPC mechanisms.

Analytic 1 - Unrecognized DLLs.

sourcetype=Sysmon EventCode=7| search module_path != "/usr/lib/" OR module_path != "/windows/system32/" OR module_path != "/lib/*"| stats count by module_path process_name user| where module_path IN ("suspicious_modules.dll", "unknown.so")
DS0009 Process Process Access

Monitor processes that attempt to access other processes, especially if the access is unusual (such as low-privileged processes interacting with high-privileged processes like a VPN service).[25]

Analytic 1 - Abnormal process access.

sourcetype=Sysmon EventCode=10| search access_type="IPC" AND process_privilege!="high"| stats count by process_name target_process_name user| where target_process_name IN ("VPNService", "Systemd", "svchost.exe")

Process Creation

Monitor the creation of processes that are related to the abuse of IPC mechanisms, particularly those that communicate with higher-privileged services or perform suspicious operations.

Analytic 1 - Processes using IPC mechanisms.

(( sourcetype=WinEventLog:Security EventCode=4688) OR (sourcetype=Sysmon EventCode=1))| search parent_process IN ("XPCService", "com.apple.securityd") OR process_name IN ("cmd.exe", "bash", "osascript")
DS0012 Script Script Execution

Monitor for any attempts to enable scripts running on a system would be considered suspicious. If scripts are not commonly used on a system, but enabled, scripts running out of cycle from patching or other administrator functions are suspicious. Scripts should be captured from the file system when possible to determine their actions and intent.

References

  1. N/A. (2021, April 1). Inter Process Communication (IPC). Retrieved March 11, 2022.
  2. Hamilton, C. (2019, June 4). Hunting COM Objects. Retrieved June 10, 2019.
  3. Haquebord, F. et al. (2022, March 17). Cyclops Blink Sets Sights on Asus Routers. Retrieved March 17, 2022.
  4. Accenture. (2020, October). Turla uses HyperStack, Carbon, and Kazuar to compromise government entity. Retrieved December 2, 2020.
  5. Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.
  6. Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.
  7. Hromcova, Z. and Burgher, A. (2023, December 14). OilRig’s persistent attacks using cloud service-powered downloaders. Retrieved November 26, 2024.
  8. Volexity Threat Research. (2024, April 12). Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400). Retrieved November 20, 2024.
  9. Lin, M. et al. (2024, February 27). Cutting Edge, Part 3: Investigating Ivanti Connect Secure VPN Exploitation and Persistence Attempts. Retrieved March 1, 2024.
  10. Christopher So. (2022, December 20). Raspberry Robin Malware Targets Telecom, Governments. Retrieved May 17, 2024.
  11. Jenkins, L. at al. (2022, August 4). ROADSWEEP Ransomware - Likely Iranian Threat Actor Conducts Politically Motivated Disruptive Activity Against Albanian Government Organizations. Retrieved August 6, 2024.
  12. Alex Turing, Hui Wang. (2021, April 28). RotaJakiro: A long live secret backdoor with 0 VT detection. Retrieved June 14, 2023.
  13. Cybereason Global SOC Team. (n.d.). THREAT ANALYSIS REPORT: Inside the LockBit Arsenal - The StealBit Exfiltration Tool. Retrieved January 29, 2025.
  1. FBI et al. (2023, May 9). Hunting Russian Intelligence “Snake” Malware. Retrieved June 8, 2023.
  2. Microsoft. (n.d.). What is Protected View?. Retrieved November 22, 2017.
  3. Brower, N. & D'Souza-Wiltshire, I. (2017, November 9). Enable Attack surface reduction. Retrieved February 3, 2018.
  4. Nelson, M. (2018, January 29). Reviving DDE: Using OneNote and Excel for Code Execution. Retrieved February 3, 2018.
  5. Microsoft. (2017, November 8). Microsoft Security Advisory 4053440 - Securely opening Microsoft Office documents that contain Dynamic Data Exchange (DDE) fields. Retrieved November 21, 2017.
  6. Cimpanu, C. (2017, December 15). Microsoft Disables DDE Feature in Word to Prevent Further Malware Attacks. Retrieved December 19, 2017.
  7. Dormann, W. (2017, October 20). Disable DDEAUTO for Outlook, Word, OneNote, and Excel versions 2010, 2013, 2016. Retrieved February 3, 2018.
  8. Microsoft. (2017, December 12). ADV170021 - Microsoft Office Defense in Depth Update. Retrieved February 3, 2018.
  9. Microsoft. (n.d.). Setting Process-Wide Security Through the Registry. Retrieved November 21, 2017.
  10. Microsoft. (n.d.). Registry Values for System-Wide Security. Retrieved November 21, 2017.
  11. Microsoft. (n.d.). DCOM Security Enhancements in Windows XP Service Pack 2 and Windows Server 2003 Service Pack 1. Retrieved November 22, 2017.
  12. VerSprite. (2018, January 24). Exploiting VyprVPN for MacOS. Retrieved April 20, 2022.