Adversaries may abuse inter-process communication (IPC) mechanisms for local code or command execution. IPC is typically used by processes to share data, communicate with each other, or synchronize execution. IPC is also commonly used to avoid situations such as deadlocks, which occurs when processes are stuck in a cyclic waiting pattern.
Adversaries may abuse IPC to execute arbitrary code or commands. IPC mechanisms may differ depending on OS, but typically exists in a form accessible through programming languages/libraries or native interfaces such as Windows Dynamic Data Exchange or Component Object Model. Linux environments support several different IPC mechanisms, two of which being sockets and pipes.[1] Higher level execution mediums, such as those of Command and Scripting Interpreters, may also leverage underlying IPC mechanisms. Adversaries may also use Remote Services such as Distributed Component Object Model to facilitate remote IPC execution.[2]
During the 3CX Supply Chain Attack, AppleJeus's VEILEDSIGNAL creates and listens on a Windows named pipe to exchange messages between modules.1
2022–2023
All 2 campaigns for this technique
16 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
Has executed via the use of subprocess.run and fed input through standard input stdin which acted as a pipe to send data from the parent process and the child process sys.executable within memory.12
Has facilitated inter-process communication between DLL components via the use of pipes.1TONESHELL has also created a reverse shell using two anonymous pipes to write data to stdin and read data from stdout and stderr.2
Inter-Process Communication detection strategy DET0493
MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detect Abuse of Inter-Process Communication (T1559)
Enterprise
3 platforms
AN1357 · Windows
Detects anomalous use of COM, DDE, or named pipes for execution. Correlates creation or access of IPC mechanisms (e.g., named pipes, COM objects) with unusual parent-child process relationships or code injection patterns (e.g., Office spawning cmd.exe via DDE).
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
open: Access to named pipes or FIFO in /tmp or /dev/shm by unexpected processes
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
SocketPathBaseline
Expected UNIX socket paths used by system services and applications.
FIFOAccessPatterns
Legitimate processes expected to open pipes in shared directories.
AN1359 · macOS
Detects anomalous use of Mach ports, Apple Events, or XPC services for inter-process execution or code injection. Focuses on unexpected processes attempting to send privileged Apple Events (e.g., automation scripts injecting into security-sensitive apps).
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
Enable the Hardened Runtime capability when developing applications. Do not include the com.apple.security.get-task-allow entitlement with the value set to any variation of true.
Registry keys specific to Microsoft Office feature control security can be set to disable automatic DDE/OLE execution. Microsoft also created, and enabled by default, Registry keys to completely disable DDE execution in Word and Excel.
Modify Registry settings (directly or using Dcomcnfg.exe) in HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AppID_GUID} associated with the process-wide security of individual COM applications.
Modify Registry settings (directly or using Dcomcnfg.exe) in HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole associated with system-wide security defaults for all COM applications that do no set their own process-wide security.
Consider disabling embedded files in Office programs, such as OneNote, that do not work with Protected View.
Tests7Executorscommand_prompt 5 · powershell 2Need elevation1 of 7Have prerequisites6Have cleanup1Platformswindows
#
Test
Platform
Executor
Elevation
Prereqs
Cleanup
Ref
01
Cobalt Strike Artifact Kit pipe
windows
command_prompt
—
1
—
Uses the Named Pipes Micro Emulation executable from the Center for Threat Informed Defense to create a named pipe for inter-process communication.
The named pipe executable will pause for 30 seconds to allow the client and server to exchange a message through the pipe.
Uses the Named Pipes Micro Emulation executable from the Center for Threat Informed Defense to create a named pipe for inter-process communication.
The named pipe executable will pause for 30 seconds to allow the client and server to exchange a message through the pipe.
Uses the Named Pipes Micro Emulation executable from the Center for Threat Informed Defense to create a named pipe for inter-process communication.
The named pipe executable will pause for 30 seconds to allow the client and server to exchange a message through the pipe.
Cobalt Strike post-exploitation pipe (4.2 and later)
windows
command_prompt
—
1
—
Uses the Named Pipes Micro Emulation executable from the Center for Threat Informed Defense to create a named pipe for inter-process communication.
The named pipe executable will pause for 30 seconds to allow the client and server to exchange a message through the pipe.
Uses the Named Pipes Micro Emulation executable from the Center for Threat Informed Defense to create a named pipe for inter-process communication.
The named pipe executable will pause for 30 seconds to allow the client and server to exchange a message through the pipe.
Creates a named pipe using PowerShell. Named pipes are a common inter-process communication mechanism
that adversaries use to facilitate data exchange between processes or as a command-and-control channel.
Inputs
Name
Description
Type
Default Value
pipe_name
Name of the named pipe to create (without the \\.\pipe\ prefix)
Named Pipe Integrity Reduction for Turla's RPC backdoor
windows
powershell
Required
1
Yes
Emulates the server-side behavior of Turla's RPC backdoors. First checks to see if the named pipe atctl is in the
registry key for NullSessionPipes, and if so, modifies the security descriptor of the pipe to allow untrusted/anonymous
integrity level callers via SetSecurityInfo. Essentially allows unauthenticated users to have privileged RCE on the server machine through RPC.
Reference: https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/
Inputs
Name
Description
Type
Default Value
pipe_name
Name of the named pipe to create
string
atctl
Attack Commandsrun with powershellelevation required (root or admin)
Add-Type @'
using System;
using System.IO.Pipes;
using System.Runtime.InteropServices;
public class TurlaPipe {
[DllImport("advapi32.dll", SetLastError = true)]
static extern uint SetSecurityInfo(SafeHandle handle, int objectType, int securityInformation, IntPtr owner, IntPtr group, IntPtr dacl, IntPtr sacl);
[DllImport("advapi32.dll", SetLastError = true, CharSet = CharSet.Unicode)]
static extern bool ConvertStringSecurityDescriptorToSecurityDescriptorW(string sddl, uint revision, out IntPtr sd, out uint size);
[DllImport("advapi32.dll")]
static extern bool GetSecurityDescriptorSacl(IntPtr pSd, out bool present, out IntPtr pSacl, out bool defaulted);
[DllImport("kernel32.dll")]
static extern IntPtr LocalFree(IntPtr hMem);
public static void CreateAndSetLabel(string pipeName) {
var pipe = new NamedPipeServerStream(pipeName, PipeDirection.InOut);
IntPtr pSd;
uint sdSize;
ConvertStringSecurityDescriptorToSecurityDescriptorW("S:(ML;;NW;;;S-1-16-0)", 1, out pSd, out sdSize);
bool present, defaulted;
IntPtr pSacl;
GetSecurityDescriptorSacl(pSd, out present, out pSacl, out defaulted);
SetSecurityInfo(pipe.SafePipeHandle, 6, 0x10, IntPtr.Zero, IntPtr.Zero, IntPtr.Zero, pSacl);
LocalFree(pSd);
pipe.Dispose();
}
}
'@
[TurlaPipe]::CreateAndSetLabel("#{pipe_name}")
The following analytic detects the creation or connection to named pipes used by potentially unwanted applications (PUAs) like VPNs or utilities like PsExec. (...)