CyberStack

MITRE ATT&CK / Techniques / T1559

Inter-Process Communication

ID
T1559
Tactics
TA0002 Execution
Platforms
Linux, macOS, Windows
Data sources
Process Access, Named Pipe Metadata, Process Creation, File Access, Script Execution
Source
attack.mitre.org
MITRE last modified
12 May 2026

Adversaries may abuse inter-process communication (IPC) mechanisms for local code or command execution. IPC is typically used by processes to share data, communicate with each other, or synchronize execution. IPC is also commonly used to avoid situations such as deadlocks, which occurs when processes are stuck in a cyclic waiting pattern.

Adversaries may abuse IPC to execute arbitrary code or commands. IPC mechanisms may differ depending on OS, but typically exists in a form accessible through programming languages/libraries or native interfaces such as Windows Dynamic Data Exchange or Component Object Model. Linux environments support several different IPC mechanisms, two of which being sockets and pipes.[11] Higher level execution mediums, such as those of Command and Scripting Interpreters, may also leverage underlying IPC mechanisms. Adversaries may also use Remote Services such as Distributed Component Object Model to facilitate remote IPC execution.[12]

Sub-techniques (3)

Detection

Mitigations (6)

M1013 Application Developer Guidance

Enable the Hardened Runtime capability when developing applications. Do not include the com.apple.security.get-task-allow entitlement with the value set to any variation of true.

M1026 Privileged Account Management

Modify Registry settings (directly or using Dcomcnfg.exe) in HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AppID_GUID} associated with the process-wide security of individual COM applications.[1]

Modify Registry settings (directly or using Dcomcnfg.exe) in HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole associated with system-wide security defaults for all COM applications that do no set their own process-wide security.[2] [3]

M1040 Behavior Prevention on Endpoint

On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent DDE attacks and spawning of child processes from Office programs.[4][5]

M1042 Disable or Remove Feature or Program

Registry keys specific to Microsoft Office feature control security can be set to disable automatic DDE/OLE execution. [6][7][8] Microsoft also created, and enabled by default, Registry keys to completely disable DDE execution in Word and Excel.[9]

M1048 Application Isolation and Sandboxing

Ensure all COM alerts and Protected View are enabled.[10]

M1054 Software Configuration

Consider disabling embedded files in Office programs, such as OneNote, that do not work with Protected View.[5][8]

Software (17)

References

  1. Microsoft Process Wide Com Keys
  2. Microsoft System Wide Com Keys
  3. Microsoft COM ACL
  4. Microsoft ASR Nov 2017
  5. Enigma Reviving DDE Jan 2018
  6. Microsoft DDE Advisory Nov 2017
  7. BleepingComputer DDE Disabled in Word Dec 2017
  8. GitHub Disable DDEAUTO Oct 2017
  9. Microsoft ADV170021 Dec 2017
  10. Microsoft Protected View
  11. Linux IPC
  12. Fireeye Hunting COM June 2019