Applied Cybernetics Group
T1559 Inter-Process Communication
- Technique
T1559- Tactics
- Execution
- Research, 90 days
- 1
- KEV CVEs mapped
- 0
- SigmaHQ rules
- 1
- Elastic, Splunk
- 19
- thrunt rules
- 0
- Upstream
- https://attack.mitre.org/techniques/T1559
MITRE description
Adversaries may abuse inter-process communication (IPC) mechanisms for local code or command execution. IPC is typically used by processes to share data, communicate with each other, or synchronize execution. IPC is also commonly used to avoid situations such as deadlocks, which occur when processes are stuck in a cyclic waiting pattern. Adversaries may abuse IPC to execute arbitrary code or commands. IPC mechanisms may differ depending on OS, but typically exists in a form accessible through programming languages/libraries or native interfaces such as Windows [Dynamic Data Exchange](https://attack.mitre.org/techniques/T1559/002) or [Component Object Model](https://attack.mitre.org/techniques/T1559/001). Linux environments support several different IPC mechanisms, two of which being sockets and pipes.(Citation: Linux IPC) Higher level execution mediums, such as those of [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059)s, may also leverage underlying IPC mechanisms. Adversaries may also use [Remote Services](https://attack.mitre.org/techniques/T1021) such as [Distributed Component Object Model](https://attack.mitre.org/techniques/T1021/003) to facilitate remote IPC execution.(Citation: Fireeye Hunting COM June 2019)
Research citing this technique
Reports and advisories from the last 90 days that cite this technique.
Detection coverage
SigmaHQ community rules
- Trickbot Malware Activity (emerging-threats)
Elastic and Splunk rules
- Unix Socket Connection (elastic)
- Unusual D-Bus Daemon Child Process (elastic)
- Suspicious Inter-Process Communication via Outlook (elastic)
- Potential Command and Control via Internet Explorer (elastic)
- Execution of COM object via Xwizard (elastic)
- Suspicious Explorer Child Process (elastic)
- Remote XSL Script Execution via COM (elastic)
- Incoming DCOM Lateral Movement via MSHTA (elastic)
- Incoming DCOM Lateral Movement with MMC (elastic)
- Incoming DCOM Lateral Movement with ShellBrowserWindow or ShellWindows (elastic)
- Suspicious Image Load (taskschd.dll) from MS Office (elastic)
- UAC Bypass Attempt with IEditionUpgradeManager Elevated COM Interface (elastic)
- UAC Bypass Attempt via Elevated COM Internet Explorer Add-On Installer (elastic)
- UAC Bypass via ICMLuaUtil Elevated COM Interface (elastic)
- Windows Anonymous Pipe Activity (splunk)
- Windows PUA Named Pipe (splunk)
- Windows RMM Named Pipe (splunk)
- Windows Suspicious C2 Named Pipe (splunk)
- Windows Suspicious Named Pipe (splunk)