Techniques › T1559
T1559 Inter-Process Communication
execution — Linux, macOS, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
3
analytics
1
Sigma rules tagged attack.t1559
0
KEV CVEs mapped here
<p>Adversaries may abuse inter-process communication (IPC) mechanisms for local code or command execution. IPC is typically used by processes to share data, communicate with each other, or synchronize execution. IPC is also commonly used to avoid situations such as deadlocks, which occurs when processes are stuck in a cyclic waiting pattern.</p><p>Adversaries may abuse IPC to execute arbitrary code or commands. IPC mechanisms may differ depending on OS, but typically exists in a form accessible through programming languages/libraries or native interfaces such as Windows Dynamic Data Exchange or Component Object Model. Linux environments support several different IPC mechanisms, two of which being sockets and pipes. Higher level execution mediums, such as those of Command and Scripting Interpreters, may also leverage underlying IPC mechanisms. Adversaries may also use Remote Services such as Distributed Component Object Model to facilitate remote IPC execution.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0493 Detect Abuse of Inter-Process Communication (T1559) v1.0
AN1357 WindowsDetects anomalous use of COM, DDE, or named pipes for execution. Correlates creation or access of IPC mechanisms (e.g., named pipes, COM objects) with unusual parent-child process relationships or code injection patterns (e.g., Office spawning cmd.exe via DDE).Tunable:
PipeNamePatternAllowedParentChildPairsAN1358 LinuxDetects abuse of UNIX domain sockets, pipes, or message queues for unauthorized code execution. Correlates unexpected socket creation with suspicious binaries, abnormal shell pipelines, or injected processes establishing IPC channels.auditd:SYSCALLsocket: Suspicious creation of AF_UNIX sockets outside expected daemons→ DC0032 Process Creationauditd:SYSCALLopen: Access to named pipes or FIFO in /tmp or /dev/shm by unexpected processes→ DC0055 File AccessTunable:SocketPathBaselineFIFOAccessPatternsAN1359 macOSDetects anomalous use of Mach ports, Apple Events, or XPC services for inter-process execution or code injection. Focuses on unexpected processes attempting to send privileged Apple Events (e.g., automation scripts injecting into security-sensitive apps).macos:unifiedlogUnusual Mach port registration or access attempts between unrelated processes→ DC0035 Process Accessmacos:osqueryexec: Unexpected execution of osascript or AppleScript targeting sensitive apps→ DC0029 Script ExecutionTunable:AllowedAppleEventTargetsMachPortBaseline
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1559
Author: Florian Roth (Nextron Systems)
· 2020-11-26 (modified 2021-11-27) · logsource: product=windows category=process_creation · 58bf96d9-ff5f-44bd-8dcc-1c4f79bf3a27
Detects Trickbot malware process tree pattern in which "rundll32.exe" is a parent of "wermgr.exe"