MITRE ATT&CKtechnique

T1559 Inter-Process Communication

Published 2020-02-12 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Execution
Platforms
Linux, macOS, Windows
Version
1.4
Created
2020-02-12

Description

Adversaries may abuse inter-process communication (IPC) mechanisms for local code or command execution. IPC is typically used by processes to share data, communicate with each other, or synchronize execution. IPC is also commonly used to avoid situations such as deadlocks, which occurs when processes are stuck in a cyclic waiting pattern. Adversaries may abuse IPC to execute arbitrary code or commands. IPC mechanisms may differ depending on OS, but typically exists in a form accessible through programming languages/libraries or native interfaces such as Windows Dynamic Data Exchange or Component Object Model. Linux environments support several different IPC mechanisms, two of which being sockets and pipes. Higher level execution mediums, such as those of Command and Scripting Interpreters, may also leverage underlying IPC mechanisms. Adversaries may also use Remote Services such as Distributed Component Object Model to facilitate remote IPC execution.

Related

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (6)

  • M1054 Software Configuration mitigation
  • M1040 Behavior Prevention on Endpoint mitigation
  • M1042 Disable or Remove Feature or Program mitigation
  • M1048 Application Isolation and Sandboxing mitigation
  • M1026 Privileged Account Management mitigation
  • M1013 Application Developer Guidance mitigation

Referenced by MITRE ATT&CK · subtechnique of (3)

Referenced by MITRE ATT&CK · uses (19)

  • S9062 MiniBrowse software (malware)
  • S9043 Mini Shai-Hulud software (malware)
  • S9024 SPAWNCHIMERA software (malware)
  • S1244 Medusa Ransomware software (malware)
  • S1239 TONESHELL software (malware)
  • C0057 3CX Supply Chain Attack campaign
  • S1229 Havoc software (malware)
  • S1200 StealBit software (malware)
  • C0048 Operation MidnightEclipse campaign
  • S1172 OilBooster software (malware)
  • S1150 ROADSWEEP software (malware)
  • S1141 LunarWeb software (malware)
  • S1130 Raspberry Robin software (malware)
  • S1123 PITSTOP software (malware)
  • S1100 Ninja software (malware)
  • S1078 RotaJakiro software (malware)
  • S0687 Cyclops Blink software (malware)
  • S0537 HyperStack software (malware)
  • S0022 Uroburos software (malware)

Referenced by Compliance · mitigates (22)

  • CIS-13.7 Deploy a Host-Based Intrusion Prevention Solution CIS Safeguard v8.1
  • CIS-16.10 Apply Secure Design Principles in Application Architectures CIS Safeguard v8.1
  • CIS-16.12 Implement Code-Level Security Checks CIS Safeguard v8.1
  • NIST-AC-2 Account Management NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-4 Information Flow Enforcement NIST 800-53 control
  • NIST-AC-5 Separation of Duties NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-CM-10 Software Usage Restrictions NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-5 Access Restrictions for Change NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-CM-7 Least Functionality NIST 800-53 control
  • NIST-CM-8 System Component Inventory NIST 800-53 control
  • NIST-IA-2 Identification and Authentication (Organizational Users) NIST 800-53 control
  • NIST-RA-5 Vulnerability Monitoring and Scanning NIST 800-53 control
  • NIST-SC-18 Mobile Code NIST 800-53 control
  • NIST-SC-3 Security Function Isolation NIST 800-53 control
  • NIST-SC-7 Boundary Protection NIST 800-53 control
  • NIST-SI-2 Flaw Remediation NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control

References