T1559 Inter-Process Communication

Enterprise

Adversaries may abuse inter-process communication (IPC) mechanisms for local code or command execution. IPC is typically used by processes to share data, communicate with each other, or synchronize execution. IPC is also commonly used to avoid situations such as deadlocks, which occurs when processes are stuck in a cyclic waiting pattern. Adversaries may abuse IPC to execute arbitrary code or commands. IPC mechanisms may differ depending on OS, but typically exists in a form accessible through programming languages/libraries or native interfaces such as Windows Dynamic Data Exchange or Component Object Model. Linux environments support several different IPC mechanisms, two of which being sockets and pipes. Higher level execution mediums, such as those of Command and Scripting Interpreters, may also leverage underlying IPC mechanisms. Adversaries may also use Remote Services such as Distributed Component Object Model to facilitate remote IPC execution.

01

Plattformen

Plattformen, für die dies gilt.

LinuxmacOSWindows
02

Taktiken

ATT&CK-Taktiken, denen diese Technik dient.

03

Untertechniken (3)

Spezifischere Einträge unterhalb dieses.

04

Gegenmaßnahmen

ATT&CK-Gegenmaßnahmen, die dies verringern.

06

NIST CSF 2.0 — Relevanzbereiche (Protect / Detect)

NIST-CSF-2.0-Bereiche mit dem größten Bezug (belegbasiert).

Abgeleitet aus MITRE CTID (Apache-2.0) und dem NIST-800-53-↔-CSF-Crosswalk (gemeinfrei). Eine indikative Relevanz entlang der Protect-/Detect-Achse — keine Compliance-Bewertung und keine Abdeckungsaussage.

08

Software (17)

Zugehörige Malware und Tools.

09

Kampagnen (2)

Kampagnen, die dies verwenden.

10

Erkannt durch (Sigma) (1)

Zugehörige Sigma-Erkennungsregeln.

11

Quelle

Wo diese Definition veröffentlicht ist.

MITRE ATT&CK