T1559 Inter-Process Communication Mappings

Adversaries may abuse inter-process communication (IPC) mechanisms for local code or command execution. IPC is typically used by processes to share data, communicate with each other, or synchronize execution. IPC is also commonly used to avoid situations such as deadlocks, which occurs when processes are stuck in a cyclic waiting pattern.

Adversaries may abuse IPC to execute arbitrary code or commands. IPC mechanisms may differ depending on OS, but typically exists in a form accessible through programming languages/libraries or native interfaces such as Windows Dynamic Data Exchange or Component Object Model. Linux environments support several different IPC mechanisms, two of which being sockets and pipes.(Citation: Linux IPC) Higher level execution mediums, such as those of Command and Scripting Interpreters, may also leverage underlying IPC mechanisms. Adversaries may also use Remote Services such as Distributed Component Object Model to facilitate remote IPC execution.(Citation: Fireeye Hunting COM June 2019)

View in MITRE ATT&CK®

NIST 800-53 Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
CM-06 Configuration Settings mitigates T1559 Inter-Process Communication
CM-05 Access Restrictions for Change mitigates T1559 Inter-Process Communication
SC-18 Mobile Code mitigates T1559 Inter-Process Communication
CM-10 Software Usage Restrictions mitigates T1559 Inter-Process Communication
SC-03 Security Function Isolation mitigates T1559 Inter-Process Communication
SI-02 Flaw Remediation mitigates T1559 Inter-Process Communication
RA-05 Vulnerability Monitoring and Scanning mitigates T1559 Inter-Process Communication
CM-08 System Component Inventory mitigates T1559 Inter-Process Communication
SI-03 Malicious Code Protection mitigates T1559 Inter-Process Communication
CM-02 Baseline Configuration mitigates T1559 Inter-Process Communication
IA-02 Identification and Authentication (Organizational Users) mitigates T1559 Inter-Process Communication
CM-07 Least Functionality mitigates T1559 Inter-Process Communication
SI-04 System Monitoring mitigates T1559 Inter-Process Communication
AC-02 Account Management mitigates T1559 Inter-Process Communication
AC-03 Access Enforcement mitigates T1559 Inter-Process Communication
AC-04 Information Flow Enforcement mitigates T1559 Inter-Process Communication
AC-05 Separation of Duties mitigates T1559 Inter-Process Communication
AC-06 Least Privilege mitigates T1559 Inter-Process Communication
SC-07 Boundary Protection mitigates T1559 Inter-Process Communication

VERIS Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1559 Inter-Process Communication

ATT&CK Subtechniques

Technique ID Technique Name Number of Mappings
T1559.002 Dynamic Data Exchange 20
T1559.001 Component Object Model 14
T1559.003 XPC Services 7