Operation MidnightEclipseC0048 ↗
During Operation MidnightEclipse, threat actors wrote output to stdout then piped it to bash for execution.1
tfMITRE ATT&CK technique
Inter-Process Communication T1559
- Tactic
- Execution
- Platforms
- Linux, macOS, Windows
- Version
- 1.4
- Created
- 12 February 2020
- Last modified
- 12 May 2026
Sub-techniques 312 rules across the family · 6 mapped directly to T1559 · 2 of 3 carry rules
Adversaries may abuse inter-process communication (IPC) mechanisms for local code or command execution. IPC is typically used by processes to share data, communicate with each other, or synchronize execution. IPC is also commonly used to avoid situations such as deadlocks, which occurs when processes are stuck in a cyclic waiting pattern.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
0
Threat groupsNone recorded
Threat groupsNone recorded · 29% of ATT&CK techniques have none either.2
CampaignsTop 17%
Campaigns83rd percentile · 83% of ATT&CK techniques have this many campaigns recorded or fewer.16
Tools & malwareTop 21%
Tools & malware79th percentile · 79% of ATT&CK techniques have this many tools implementing them or fewer.6
Detection rules67th pct
Detection rules67th percentile · 67% of ATT&CK techniques have this many detection rules written or fewer.Inter-Process Communication MITRE reference T1559
Top 17%of all ATT&CK techniques for number of campaigns
2 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
3CX Supply Chain AttackC0057 ↗
During the 3CX Supply Chain Attack, AppleJeus's VEILEDSIGNAL creates and listens on a Windows named pipe to exchange messages between modules.1
All 2 campaigns for this technique
16 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
Mini Shai-HuludS9043 ↗
Has executed via the use of subprocess.run and fed input through standard input stdin which acted as a pipe to send data from the parent process and the child process sys.executable within memory.12
SPAWNCHIMERAS9024 ↗
Has leveraged IPC using a UNIX domain socket between the dsmdm process and the web process.12
Medusa RansomwareS1244 ↗
Has leveraged the CreatePipe API to enable inter-process communication.1
TONESHELLS1239 ↗
Has facilitated inter-process communication between DLL components via the use of pipes.1 TONESHELL has also created a reverse shell using two anonymous pipes to write data to stdin and read data from stdout and stderr.2
HavocS1229 ↗
The Havoc SMB demon can use named pipes for communication through a parent demon.1
StealBitS1200 ↗
Can use interprocess communication (IPC) to enable the designation of multiple files for exfiltration in a scalable manner.1
All 16 software entries for this technique · 6 newest in this preview
Offense vs defense T1559
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 2Sigma rules (cumulative) · 1Splunk ESCU (cumulative) · 5
first rule: 2020 Q4 · 2 of 2 campaigns plottedInter-Process Communication detection strategy DET0493
MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detect Abuse of Inter-Process Communication (T1559)
3 platforms
AN1357 · Windows
Detects anomalous use of COM, DDE, or named pipes for execution. Correlates creation or access of IPC mechanisms (e.g., named pipes, COM objects) with unusual parent-child process relationships or code injection patterns (e.g., Office spawning cmd.exe via DDE).
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process AccessDC0035 | WinEventLog:Security | EventCode=4663, 4670, 4656 |
| Named Pipe MetadataDC0048 | WinEventLog:Sysmon | EventCode=17 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| PipeNamePattern | Environment-specific pipe names used legitimately vs anomalous (e.g., \\.\pipe\svcctl). |
| AllowedParentChildPairs | Expected parent-child process lineage to minimize false positives (e.g., explorer.exe spawning outlook.exe). |
AN1358 · Linux
Detects abuse of UNIX domain sockets, pipes, or message queues for unauthorized code execution. Correlates unexpected socket creation with suspicious binaries, abnormal shell pipelines, or injected processes establishing IPC channels.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | auditd:SYSCALL | socket: Suspicious creation of AF_UNIX sockets outside expected daemons |
| File AccessDC0055 | auditd:SYSCALL | open: Access to named pipes or FIFO in /tmp or /dev/shm by unexpected processes |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| SocketPathBaseline | Expected UNIX socket paths used by system services and applications. |
| FIFOAccessPatterns | Legitimate processes expected to open pipes in shared directories. |
AN1359 · macOS
Detects anomalous use of Mach ports, Apple Events, or XPC services for inter-process execution or code injection. Focuses on unexpected processes attempting to send privileged Apple Events (e.g., automation scripts injecting into security-sensitive apps).
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Script ExecutionDC0029 | macos:osquery | exec: Unexpected execution of osascript or AppleScript targeting sensitive apps |
| Process AccessDC0035 | macos:unifiedlog | Unusual Mach port registration or access attempts between unrelated processes |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| AllowedAppleEventTargets | Whitelisted app-to-app Apple Event communications (e.g., Finder automation). |
| MachPortBaseline | Baseline of Mach ports and XPC services normally used in the environment. |
Enable the Hardened Runtime capability when developing applications. Do not include the com.apple.security.get-task-allow entitlement with the value set to any variation of true.
Ensure all COM alerts and Protected View are enabled.
On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent DDE attacks and spawning of child processes from Office programs.
Registry keys specific to Microsoft Office feature control security can be set to disable automatic DDE/OLE execution. Microsoft also created, and enabled by default, Registry keys to completely disable DDE execution in Word and Excel.
Modify Registry settings (directly or using Dcomcnfg.exe) in HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AppID_GUID} associated with the process-wide security of individual COM applications.
Modify Registry settings (directly or using Dcomcnfg.exe) in HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole associated with system-wide security defaults for all COM applications that do no set their own process-wide security.
Consider disabling embedded files in Office programs, such as OneNote, that do not work with Protected View.
Tests5Executorscmd 5Need elevation0 of 5Have prerequisites5Have cleanup0Platformswindows
| # | Test | Platform | Executor | Elevation | Prereqs | Cleanup | Ref | |
|---|---|---|---|---|---|---|---|---|
| 01 | Cobalt Strike Artifact Kit pipe | windows | cmd | — | 1 | — | ||
Uses the Named Pipes Micro Emulation executable from the Center for Threat Informed Defense to create a named pipe for inter-process communication. The named pipe executable will pause for 30 seconds to allow the client and server to exchange a message through the pipe. Attack command "PathToAtomicsFolder\..\ExternalPayloads\build\namedpipes_executor.exe" --pipe 1 Prerequisite Named pipe executors must exist on disk Check if ((Test-Path "PathToAtomicsFolder\..\ExternalPayloads\build\namedpipes_executor.exe") -and (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\build\namedpipes_client.exe") -and (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\build\namedpipes_server.exe")) {exit 0} else {exit 1}
Satisfy New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction ignore -Force | Out-Null [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 IEX (iwr "https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/Public/Invoke-FetchFromZip.ps1" -UseBasicParsing) $zipUrl = "https://github.com/center-for-threat-informed-defense/adversary_emulation_library/raw/master/micro_emulation_plans/src/named_pipes/named_pipes.zip" Invoke-FetchFromZip $zipUrl "*.exe" "PathToAtomicsFolder\..\ExternalPayloads" GUID8ff9f312-0a1a-44ef-a017-0f61fc1bb942 | ||||||||
| 02 | Cobalt Strike Lateral Movement (psexec_psh) pipe | windows | cmd | — | 1 | — | ||
Uses the Named Pipes Micro Emulation executable from the Center for Threat Informed Defense to create a named pipe for inter-process communication. The named pipe executable will pause for 30 seconds to allow the client and server to exchange a message through the pipe. Attack command "PathToAtomicsFolder\..\ExternalPayloads\build\namedpipes_executor.exe" --pipe 2 Prerequisite Named pipe executors must exist on disk Check if ((Test-Path "PathToAtomicsFolder\..\ExternalPayloads\build\namedpipes_executor.exe") -and (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\build\namedpipes_client.exe") -and (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\build\namedpipes_server.exe")) {exit 0} else {exit 1}
Satisfy New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction ignore -Force | Out-Null [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 IEX (iwr "https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/Public/Invoke-FetchFromZip.ps1" -UseBasicParsing) $zipUrl = "https://github.com/center-for-threat-informed-defense/adversary_emulation_library/raw/master/micro_emulation_plans/src/named_pipes/named_pipes.zip" Invoke-FetchFromZip $zipUrl "*.exe" "PathToAtomicsFolder\..\ExternalPayloads" GUID3d5e7f7a-833b-4858-9105-055b5ed94d00 | ||||||||
| 03 | Cobalt Strike SSH (postex_ssh) pipe | windows | cmd | — | 1 | — | ||
Uses the Named Pipes Micro Emulation executable from the Center for Threat Informed Defense to create a named pipe for inter-process communication. The named pipe executable will pause for 30 seconds to allow the client and server to exchange a message through the pipe. Attack command "PathToAtomicsFolder\..\ExternalPayloads\build\namedpipes_executor.exe" --pipe 3 Prerequisite Named pipe executors must exist on disk Check if ((Test-Path "PathToAtomicsFolder\..\ExternalPayloads\build\namedpipes_executor.exe") -and (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\build\namedpipes_client.exe") -and (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\build\namedpipes_server.exe")) {exit 0} else {exit 1}
Satisfy New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction ignore -Force | Out-Null [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 IEX (iwr "https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/Public/Invoke-FetchFromZip.ps1" -UseBasicParsing) $zipUrl = "https://github.com/center-for-threat-informed-defense/adversary_emulation_library/raw/master/micro_emulation_plans/src/named_pipes/named_pipes.zip" Invoke-FetchFromZip $zipUrl "*.exe" "PathToAtomicsFolder\..\ExternalPayloads" GUID952b95cb-0ee4-464b-95cf-0d18094a0e66 | ||||||||
| 04 | Cobalt Strike post-exploitation pipe (4.2 and later) | windows | cmd | — | 1 | — | ||
Uses the Named Pipes Micro Emulation executable from the Center for Threat Informed Defense to create a named pipe for inter-process communication. The named pipe executable will pause for 30 seconds to allow the client and server to exchange a message through the pipe. Attack command "PathToAtomicsFolder\..\ExternalPayloads\build\namedpipes_executor.exe" --pipe 4 Prerequisite Named pipe executors must exist on disk Check if ((Test-Path "PathToAtomicsFolder\..\ExternalPayloads\build\namedpipes_executor.exe") -and (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\build\namedpipes_client.exe") -and (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\build\namedpipes_server.exe")) {exit 0} else {exit 1}
Satisfy New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction ignore -Force | Out-Null [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 IEX (iwr "https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/Public/Invoke-FetchFromZip.ps1" -UseBasicParsing) $zipUrl = "https://github.com/center-for-threat-informed-defense/adversary_emulation_library/raw/master/micro_emulation_plans/src/named_pipes/named_pipes.zip" Invoke-FetchFromZip $zipUrl "*.exe" "PathToAtomicsFolder\..\ExternalPayloads" GUID7a5a87bd-fe13-4ca2-a977-c995931d6c2f | ||||||||
| 05 | Cobalt Strike post-exploitation pipe (before 4.2) | windows | cmd | — | 1 | — | ||
Uses the Named Pipes Micro Emulation executable from the Center for Threat Informed Defense to create a named pipe for inter-process communication. The named pipe executable will pause for 30 seconds to allow the client and server to exchange a message through the pipe. Attack command "PathToAtomicsFolder\..\ExternalPayloads\build\namedpipes_executor.exe" --pipe 5 Prerequisite Named pipe executors must exist on disk Check if ((Test-Path "PathToAtomicsFolder\..\ExternalPayloads\build\namedpipes_executor.exe") -and (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\build\namedpipes_client.exe") -and ("Test-Path PathToAtomicsFolder\..\ExternalPayloads\build\namedpipes_server.exe")) {exit 0} else {exit 1}
Satisfy New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction ignore -Force | Out-Null [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 IEX (iwr "https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/Public/Invoke-FetchFromZip.ps1" -UseBasicParsing) $zipUrl = "https://github.com/center-for-threat-informed-defense/adversary_emulation_library/raw/master/micro_emulation_plans/src/named_pipes/named_pipes.zip" Invoke-FetchFromZip $zipUrl "*.exe" "PathToAtomicsFolder\..\ExternalPayloads" GUIDc1310afb-7222-4cd6-8107-b916e115ea53 | ||||||||
Tests from Atomic Red Team (MIT licence) · technique definition