tfMITRE ATT&CK sub-technique

Dynamic Data Exchange T1559.002

sub-technique of T1559 Inter-Process Communication

Tactic: Execution
Platform: Windows
Version: 1.4
Created: 12 February 2020
Last modified: 24 October 2025

Adversaries may use Windows Dynamic Data Exchange (DDE) to execute arbitrary commands. DDE is a client-server protocol for one-time and/or continuous inter-process communication (IPC) between applications. Once a link is established, applications can autonomously exchange transactions consisting of strings, warm data links (notifications when a data item changes), hot data links (duplications of changes to a data item), and requests for command execution.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 17%

Threat groups83rd percentile · 83% of ATT&CK techniques have this many threat groups attributed or fewer.

Campaigns72nd pct

Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malware72nd pct

Tools & malware72nd percentile · 72% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules42nd pct

Detection rules42nd percentile · 58% of ATT&CK techniques have more detection rules written.

Dynamic Data Exchange MITRE reference T1559.002

Top 17%of all ATT&CK techniques for number of groups

11 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

BITTERG1002 ↗

Has executed OLE objects using Microsoft Equation Editor to download and run malicious payloads.1

created 2022-06-011 referenceaka T-APT-17

SidewinderG0121 ↗

Has used the ActiveXObject utility to create OLE objects to obtain execution through Internet Explorer.1 2

created 2021-01-272 referencesaka T-APT-04

TA505G0092 ↗

Has leveraged malicious Word documents that abused DDE.1

created 2019-05-281 referenceaka Hive0065

GallmakerG0084 ↗

Attempted to exploit Microsoft’s DDE protocol in order to gain access to victim machines and for execution.1

created 2019-01-301 reference

Cobalt GroupG0080 ↗

Has sent malicious Word OLE compound documents to victims.1

created 2018-10-171 referenceaka GOLD KINGSWOOD

APT37G0067 ↗

Has used Windows DDE for execution of commands and a malicious VBS.1

created 2018-04-181 referenceaka InkySquid

All 11 groups for this technique · 6 newest in this preview

Offense vs defense T1559.002

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 1Sigma rules (cumulative) · 1Splunk ESCU (cumulative) · 0

first rule: 2022 Q1 · 1 of 1 campaigns plotted

Dynamic Data Exchange detection strategy DET0504

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detect Abuse of Dynamic Data Exchange (T1559.002)

Enterprise

1 platform

AN1393 · Windows

Detects anomalous use of Dynamic Data Exchange (DDE) for code execution, such as Office applications (WINWORD.EXE, EXCEL.EXE) spawning command interpreters, or loading unusual modules through DDEAUTO/DDE formulas. Correlates suspicious parent-child process relationships, registry keys enabling DDE, and module loads inconsistent with normal Office usage.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Module LoadDC0016	WinEventLog:Sysmon	EventCode=7
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Windows Registry Key AccessDC0050	WinEventLog:Security	EventCode=4663, 4670, 4656

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
AllowedParentChildPairs	Define legitimate parent-child relationships for Office processes to reduce false positives.
TimeWindow	Threshold for correlating Office process creation with subsequent command execution via DDE.
SuspiciousDLLList	Maintain allow/block list of DLLs that Office is expected to load.

1 analytic

TypeTTPCoverageLowSubmitted2020

D3FEND techniques

The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.

ID	Name
D3-PSA	Process Spawn Analysis

Data model references

The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.

Object	Action	Field
process	create	command_line

Implementations

Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.

This Splunk query looks for any executable invocations from an Excel file.

index = __your_sysmon__index__ (ParentImage="*excel.exe" OR ParentImage="*word.exe" OR ParentImage="*outlook.exe") Image="*.exe"

This Splunk query looks for any executable invocations from an Excel file.

processes = search Process:Create
target_processes = filter processes where (
     (parent_image="*excel.exe" OR parent_image="*word.exe" OR parent_image="*outlook.exe")
     AND image="*.exe"
     )

Tests3Executorsmanual 2 · cmd 1Need elevation0 of 3Have prerequisites0Have cleanup0Platformswindows

#	Test	Platform	Executor	Elevation	Prereqs	Cleanup
01	Execute Commands	windows	manual	—	—	—
Executes commands via DDE using Microsfot Word Attack command No command — this test is a manual procedure. GUID196ed548-2001-4527-8b1e-b2f798a598df
02	Execute PowerShell script via Word DDE	windows	cmd	—	—	—
When the word document opens it will prompt the user to click ok on a dialogue box, then attempt to run PowerShell with DDEAUTO to download and execute a powershell script Attack command start "$PathToAtomicsFolder\T1559.002\bin\DDE_Document.docx" GUID7d3ed679-603b-4c10-a99b-219a8a7b70df
03	DDEAUTO	windows	manual	—	—	—
TrustedSec - Unicorn - https://github.com/trustedsec/unicorn SensePost DDEAUTO - https://sensepost.com/blog/2017/macro-less-code-exec-in-msword/ Word VBA Macro Dragon's Tail Attack command No command — this test is a manual procedure. GUID244bf403-ad6b-4357-82fe-1dacd0f19cf7

Tests from Atomic Red Team (MIT licence) · technique definition

Dynamic Data Exchange detections T1559.002

1 rule is mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

42nd pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs