Cross-source coverage
T1559 / ATT&CK
Inter-Process Communication
39 rules across 7 sources.
From MITRE ATT&CK 19.2
Adversaries may abuse inter-process communication (IPC) mechanisms for local code or command execution. IPC is typically used by processes to share data, communicate with each other, or synchronize execution. IPC is also commonly used to avoid situations such as deadlocks, which occurs when processes are stuck in a cyclic waiting pattern.
Adversaries may abuse IPC to execute arbitrary code or commands. IPC mechanisms may differ depending on OS, but typically exists in a form accessible through programming languages/libraries or native interfaces such as Windows Dynamic Data Exchange or Component Object Model. Linux environments support several different IPC mechanisms, two of which being sockets and pipes. Higher level execution mediums, such as those of Command and Scripting Interpreters, may also leverage underlying IPC mechanisms. Adversaries may also use Remote Services such as Distributed Component Object Model to facilitate remote IPC execution.
- Tactics
- Execution
- Platforms
- Linux · macOS · Windows
- Telemetry
-
WinEventLog:SecurityWinEventLog:Sysmonauditd:SYSCALLmacos:unifiedlogmacos:osquery
How MITRE says to detect it DET0493
Detect Abuse of Inter-Process Communication (T1559)
Windows Analytic 1357
Detects anomalous use of COM, DDE, or named pipes for execution. Correlates creation or access of IPC mechanisms (e.g., named pipes, COM objects) with unusual parent-child process relationships or code injection patterns (e.g., Office spawning cmd.exe via DDE).
WinEventLog:SecurityEventCode=4663, 4670, 4656WinEventLog:SysmonEventCode=17
Linux Analytic 1358
Detects abuse of UNIX domain sockets, pipes, or message queues for unauthorized code execution. Correlates unexpected socket creation with suspicious binaries, abnormal shell pipelines, or injected processes establishing IPC channels.
auditd:SYSCALLsocket: Suspicious creation of AF_UNIX sockets outside expected daemonsauditd:SYSCALLopen: Access to named pipes or FIFO in /tmp or /dev/shm by unexpected processes
macOS Analytic 1359
Detects anomalous use of Mach ports, Apple Events, or XPC services for inter-process execution or code injection. Focuses on unexpected processes attempting to send privileged Apple Events (e.g., automation scripts injecting into security-sensitive apps).
macos:unifiedlogUnusual Mach port registration or access attempts between unrelated processesmacos:osqueryexec: Unexpected execution of osascript or AppleScript targeting sensitive apps
Sub-techniques with coverage
Counted in the 39 above — a rule tagged a sub-technique covers this technique too.
elastic/detection-rules
14 rules| Detection | Severity | Format |
|---|---|---|
| Incoming DCOM Lateral Movement via MSHTA | High | Elastic TOML |
| Incoming DCOM Lateral Movement with MMC | High | Elastic TOML |
| UAC Bypass Attempt with IEditionUpgradeManager Elevated COM Interface | High | Elastic TOML |
| UAC Bypass via ICMLuaUtil Elevated COM Interface | High | Elastic TOML |
| Execution of COM object via Xwizard | Medium | Elastic TOML |
| Incoming DCOM Lateral Movement with ShellBrowserWindow or ShellWindows | Medium | Elastic TOML |
| Potential Command and Control via Internet Explorer | Medium | Elastic TOML |
| Suspicious Explorer Child Process | Medium | Elastic TOML |
| Suspicious Inter-Process Communication via Outlook | Medium | Elastic TOML |
| UAC Bypass Attempt via Elevated COM Internet Explorer Add-On Installer | Medium | Elastic TOML |
+ 4 more from elastic/detection-rules → showing the 10 highest-severity
elastic/protections-artifacts
7 rules| Detection | Severity | Format |
|---|---|---|
| File Cloned by Unsigned or Untrusted Process | Undefined | Elastic TOML |
| Suspicious Command and Control via Internet Explorer | Undefined | Elastic TOML |
| Suspicious Installer Remote Plugin Service Child Process | Undefined | Elastic TOML |
| Suspicious Windows Component Object Model via DLLHOST | Undefined | Elastic TOML |
| Suspicious XPC Service Child Process | Undefined | Elastic TOML |
| Unsigned or Untrusted Application Launch via XPC | Undefined | Elastic TOML |
| Unsigned or Untrusted Binary Execution via XPC call | Undefined | Elastic TOML |
SigmaHQ/sigma
6 rules| Detection | Severity | Format |
|---|---|---|
| CMSTP Execution Process Access | High | Sigma |
| Trickbot Malware Activity | High | Sigma |
| Dllhost.EXE Initiated Network Connection To Non-Local IP Address | Medium | Sigma |
| DNS Query Request By Regsvr32.EXE | Medium | Sigma |
| Enable Microsoft Dynamic Data Exchange | Medium | Sigma |
| Network Connection Initiated By Regsvr32.EXE | Medium | Sigma |
splunk/security_content
6 rules| Detection | Severity | Format |
|---|---|---|
| Process Writing DynamicWrapperX | Undefined | SPL |
| Windows Anonymous Pipe Activity | Undefined | SPL |
| Windows PUA Named Pipe | Undefined | SPL |
| Windows RMM Named Pipe | Undefined | SPL |
| Windows Suspicious C2 Named Pipe | Undefined | SPL |
| Windows Suspicious Named Pipe | Undefined | SPL |
socfortress/Wazuh-Rules
4 rules| Detection | Severity | Format |
|---|---|---|
| Sysmon - Event 1: Process creation · Named Pipe Client (T1559) | High | Wazuh XML |
| Sysmon - Event 1: Process creation · Named Pipe Execution via Argument (T1559) | High | Wazuh XML |
| Sysmon - Event 1: Process creation · Named Pipe Executor (T1559) | High | Wazuh XML |
| Sysmon - Event 1: Process creation · Named Pipe Server (T1559) | High | Wazuh XML |
Azure/Azure-Sentinel
1 rule| Detection | Severity | Format |
|---|---|---|
| detect-impacket-dcomexec | Undefined | KQL |
Wazuh Core Ruleset
1 rule| Detection | Severity | Format |
|---|---|---|
| Office application invoked Verclsid.exe, possible COM payload execution | High | Wazuh XML |