T1559 · Inter-Process Communication

Sunturai

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice

T1559 · Inter-Process Communication · Sunturai

attack-patternenterprise-attackT1559

Inter-Process Communication

attack-pattern--acd0ba37-7ba9-4cc5-ac61-796586cd856d

Adversaries may abuse inter-process communication (IPC) mechanisms for local code or command execution. IPC is typically used by processes to share data, communicate with each other, or synchronize execution. IPC is also commonly used to avoid situations such as deadlocks, which occurs when processes are stuck in a cyclic waiting pattern. Adversaries may abuse IPC to execute arbitrary code or commands. IPC mechanisms may differ depending on OS, but typically exists in a form accessible through programming languages/libraries or native interfaces such as Windows Dynamic Data Exchange or Component Object Model. Linux environments support several different IPC mechanisms, two of which being sockets and pipes.(Citation: Linux IPC) Higher level execution mediums, such as those of Command and Scripting Interpreters, may also leverage underlying IPC mechanisms. Adversaries may also use Remote Services such as Distributed Component Object Model to facilitate remote IPC execution.(Citation: Fireeye Hunting COM June 2019)

Created: Feb 12, 2020, 2:08 PM UTC
Modified: May 12, 2026, 3:12 PM UTC

3 sub-techniques under this technique

Each is its own technique in the catalogue, with its own detections.

21 published detections cover this technique

Every one carries the source it came from and the licence it was published under.

Detections covering this technique
Detection	Severity	Source	Published	Licence
Windows Suspicious Named Pipe	Medium	Splunk security content	Oct 6, 2026	Apache License 2.0
Windows Suspicious C2 Named Pipe	Medium	Splunk security content	Oct 6, 2026	Apache License 2.0
Windows RMM Named Pipe	Informational	Splunk security content	Oct 6, 2026	Apache License 2.0
Windows PUA Named Pipe	Informational	Splunk security content	Oct 6, 2026	Apache License 2.0
UAC Bypass via ICMLuaUtil Elevated COM Interface	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
UAC Bypass Attempt via Elevated COM Internet Explorer Add-On Installer	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
UAC Bypass Attempt with IEditionUpgradeManager Elevated COM Interface	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Suspicious Image Load (taskschd.dll) from MS Office	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Incoming DCOM Lateral Movement with ShellBrowserWindow or ShellWindows	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Incoming DCOM Lateral Movement with MMC	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Incoming DCOM Lateral Movement via MSHTA	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Remote XSL Script Execution via COM	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Suspicious Explorer Child Process	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Execution of COM object via Xwizard	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Potential Command and Control via Internet Explorer	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Suspicious Inter-Process Communication via Outlook	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Unusual D-Bus Daemon Child Process	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Unix Socket Connection	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Suspicious named pipes	Medium	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
Azure DevOps Personal Access Token (PAT) misuse	High	Microsoft Sentinel analytics	Aug 29, 2026	MIT License
Windows Anonymous Pipe Activity	Medium	Splunk security content	Aug 26, 2026	Apache License 2.0

Showing 21 of 21

Filter in the catalogue

External references

mitre-attackT1559Open reference

Fireeye Hunting COM June 2019Open reference

Linux IPCOpen reference

Platforms

LinuxmacOSWindows

Kill chain phases

execution

Relationships

Incoming and outgoing edges in the selected ATT&CK release.

Incoming and outgoing edges in the selected ATT&CK release
Direction	Type	Related object