Inter-Process Communication

Adversaries may abuse inter-process communication (IPC) mechanisms for local code or command execution. IPC is typically used by processes to share data, communicate with each other, or synchronize execution. IPC is also commonly used to avoid situations such as deadlocks, which occurs when processes are stuck in a cyclic waiting pattern.

Adversaries may abuse IPC to execute arbitrary code or commands. IPC mechanisms may differ depending on OS, but typically exists in a form accessible through programming languages/libraries or native interfaces such as Windows Dynamic Data Exchange or Component Object Model. Higher level execution mediums, such as those of Command and Scripting Interpreters, may also leverage underlying IPC mechanisms.

ID: T1559
Sub-techniques:  T1559.001, T1559.002
Tactic: Execution
Platforms: Windows
Permissions Required: Administrator, SYSTEM, User
Data Sources: DLL monitoring, File monitoring, Process monitoring
Version: 1.0
Created: 12 February 2020
Last Modified: 28 March 2020

Mitigations

Mitigation Description
Application Isolation and Sandboxing

Ensure all COM alerts and Protected View are enabled.[1]

Behavior Prevention on Endpoint

On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent DDE attacks and spawning of child processes from Office programs.[2][3]

Disable or Remove Feature or Program

Registry keys specific to Microsoft Office feature control security can be set to disable automatic DDE/OLE execution. [4][5][6] Microsoft also created, and enabled by default, Registry keys to completely disable DDE execution in Word and Excel.[7]

Privileged Account Management

Modify Registry settings (directly or using Dcomcnfg.exe) in HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{{AppID_GUID}} associated with the process-wide security of individual COM applications.[8]

Modify Registry settings (directly or using Dcomcnfg.exe) in HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole associated with system-wide security defaults for all COM applications that do no set their own process-wide security.[9] [10]

Software Configuration

Consider disabling embedded files in Office programs, such as OneNote, that do not work with Protected View.[3][6]

Detection

Monitor for strings in files/commands, loaded DLLs/libraries, or spawned processes that are associated with abuse of IPC mechanisms.

References