MITRE ATT&CKsub-technique

T1559.002 Dynamic Data Exchange

Published 2020-02-12 Modified 2025-10-24 Official page ↗
Domain
enterprise
Tactics
Execution
Platforms
Windows
Version
1.4
Created
2020-02-12

Description

Adversaries may use Windows Dynamic Data Exchange (DDE) to execute arbitrary commands. DDE is a client-server protocol for one-time and/or continuous inter-process communication (IPC) between applications. Once a link is established, applications can autonomously exchange transactions consisting of strings, warm data links (notifications when a data item changes), hot data links (duplications of changes to a data item), and requests for command execution. Object Linking and Embedding (OLE), or the ability to link data between documents, was originally implemented through DDE. Despite being superseded by Component Object Model, DDE may be enabled in Windows 10 and most of Microsoft Office 2016 via Registry keys. Microsoft Office documents can be poisoned with DDE commands, directly or through embedded files, and used to deliver execution via Phishing campaigns or hosted Web content, avoiding the use of Visual Basic for Applications (VBA) macros. Similarly, adversaries may infect payloads to execute applications and/or commands on a victim device by way of embedding DDE formulas within a CSV file intended to be opened through a Windows spreadsheet program. DDE could also be leveraged by an adversary operating on a compromised machine who does not have direct access to a Command and Scripting Interpreter. DDE execution can be invoked remotely via Remote Services such as Distributed Component Object Model (DCOM).

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1559 Inter-Process Communication technique

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (4)

  • M1054 Software Configuration mitigation
  • M1040 Behavior Prevention on Endpoint mitigation
  • M1042 Disable or Remove Feature or Program mitigation
  • M1048 Application Isolation and Sandboxing mitigation

Referenced by MITRE ATT&CK · uses (20)

  • C0013 Operation Sharpshooter campaign
  • G1002 BITTER group
  • G0121 Sidewinder group
  • S0476 Valak software (malware)
  • S0458 Ramsay software (malware)
  • S0428 PoetRAT software (malware)
  • S0391 HAWKBALL software (malware)
  • S0387 KeyBoy software (malware)
  • G0092 TA505 group
  • G0084 Gallmaker group
  • G0080 Cobalt Group group
  • S0237 GravityRAT software (malware)
  • G0065 Leviathan group
  • G0067 APT37 group
  • G0069 MuddyWater group
  • S0223 POWERSTATS software (malware)
  • G0007 APT28 group
  • G0040 Patchwork group
  • G0046 FIN7 group
  • S0148 RTM software (malware)

Referenced by Compliance · mitigates (16)

  • CIS-13.7 Deploy a Host-Based Intrusion Prevention Solution CIS Safeguard v8.1
  • CIS-18.3 Remediate Penetration Test Findings CIS Safeguard v8.1
  • NIST-AC-4 Information Flow Enforcement NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-CM-10 Software Usage Restrictions NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-CM-7 Least Functionality NIST 800-53 control
  • NIST-CM-8 System Component Inventory NIST 800-53 control
  • NIST-RA-5 Vulnerability Monitoring and Scanning NIST 800-53 control
  • NIST-SC-18 Mobile Code NIST 800-53 control
  • NIST-SC-3 Security Function Isolation NIST 800-53 control
  • NIST-SC-7 Boundary Protection NIST 800-53 control
  • NIST-SI-2 Flaw Remediation NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control

References