Inter-Process Communication

Adversaries may abuse inter-process communication (IPC) mechanisms for local code or command execution. IPC is typically used by processes to share data, communicate with each other, or synchronize execution. IPC is also commonly used to avoid situations such as deadlocks, which occurs when processes are stuck in a cyclic waiting pattern.

Adversaries may abuse IPC to execute arbitrary code or commands. IPC mechanisms may differ depending on OS, but typically exists in a form accessible through programming languages/libraries or native interfaces such as Windows Dynamic Data Exchange or Component Object Model. Linux environments support several different IPC mechanisms, two of which being sockets and pipes.[1] Higher level execution mediums, such as those of Command and Scripting Interpreters, may also leverage underlying IPC mechanisms. Adversaries may also use Remote Services such as Distributed Component Object Model to facilitate remote IPC execution.[2]

ID: T1559
Sub-techniques:  T1559.001, T1559.002, T1559.003
Tactic: Execution
Platforms: Linux, Windows, macOS
Permissions Required: Administrator, SYSTEM, User
Supports Remote:  Yes
Version: 1.2
Created: 12 February 2020
Last Modified: 11 March 2022

Procedure Examples

ID Name Description
S0687 Cyclops Blink

Cyclops Blink has the ability to create a pipe to enable inter-process communication.[3]

S0537 HyperStack

HyperStack can connect to the IPC$ share on remote machines.[4]

S1078 RotaJakiro

When executing with non-root permissions, RotaJakiro uses the the shmget API to create shared memory between other known RotaJakiro processes. This allows processes to communicate with each other and share their PID.[5]

S0022 Uroburos

Uroburos has the ability to move data between its kernel and user mode components, generally using named pipes.[6]

Mitigations

ID Mitigation Description
M1013 Application Developer Guidance

Enable the Hardened Runtime capability when developing applications. Do not include the com.apple.security.get-task-allow entitlement with the value set to any variation of true.

M1048 Application Isolation and Sandboxing

Ensure all COM alerts and Protected View are enabled.[7]

M1040 Behavior Prevention on Endpoint

On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent DDE attacks and spawning of child processes from Office programs.[8][9]

M1042 Disable or Remove Feature or Program

Registry keys specific to Microsoft Office feature control security can be set to disable automatic DDE/OLE execution. [10][11][12] Microsoft also created, and enabled by default, Registry keys to completely disable DDE execution in Word and Excel.[13]

M1026 Privileged Account Management

Modify Registry settings (directly or using Dcomcnfg.exe) in HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AppID_GUID} associated with the process-wide security of individual COM applications.[14]

Modify Registry settings (directly or using Dcomcnfg.exe) in HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole associated with system-wide security defaults for all COM applications that do no set their own process-wide security.[15] [16]

M1054 Software Configuration

Consider disabling embedded files in Office programs, such as OneNote, that do not work with Protected View.[9][12]

Detection

ID Data Source Data Component Detects
DS0011 Module Module Load

Monitor DLL/PE file events, specifically creation of these binary files as well as the loading of DLLs into processes. Look for DLLs that are not recognized or not normally loaded into a process.

DS0009 Process Process Access

Monitor for processes making abnormal calls to higher privileged processes, such as a user application connecting to a VPN service.[17]

Process Creation

Monitor for newly executed processes that are associated with abuse of IPC mechanisms

DS0012 Script Script Execution

Monitor for any attempts to enable scripts running on a system would be considered suspicious. If scripts are not commonly used on a system, but enabled, scripts running out of cycle from patching or other administrator functions are suspicious. Scripts should be captured from the file system when possible to determine their actions and intent.

References