ATT&CK T1559 Inter-Process Communication Detection Guide

Operating systems let processes ask each other to do work, and attackers use those same channels to run code from a document, a script or a low-privileged process without starting an obvious interpreter. MITRE ATT&CK T1559 Inter-Process Communication covers abuse of IPC mechanisms for local code or command execution. It has three sub-techniques in ATT&CK v20: T1559.001 Component Object Model, T1559.002 Dynamic Data Exchange and T1559.003 XPC Services, and the parent also covers Linux mechanisms such as sockets and pipes. The technique sits in the Execution tactic (TA0002) and applies to Windows, macOS and Linux. This guide covers how each mechanism is abused, the detection analytics ATT&CK publishes for each, the specific Office, COM and macOS settings that reduce exposure, and how to respond. It is for detection engineers, endpoint engineers and macOS administrators. The execution tactic as a whole is mapped in the ATT&CK Execution Tactic Guide; this page goes deeper on T1559 only.

Key takeaways

DDE is macro-less document execution. ATT&CK notes poisoned Office documents and CSV files can use DDE to run commands while avoiding VBA macros, so macro blocking alone does not close it.
COM objects do more than run code. ATT&CK records COM being used to create scheduled tasks, download and execute files, and support privilege escalation and persistence.
XPC abuse targets privileged helpers. On macOS the XPC daemon runs as root, and third-party helper tools that fail to validate clients can be driven to run code with elevated rights.
Office parent processes are the best signal. Every Windows analytic ATT&CK publishes for T1559 looks for Office or other user applications spawning interpreters or loading unusual modules.
Settings exist for each mechanism. Office link-update and DDE registry values, Protected View, attack surface reduction rules, COM security registry keys and the macOS Hardened Runtime each address a specific sub-technique.

The IPC mechanisms in scope

Mechanism	ATT&CK ID	Platform	How it is abused (per ATT&CK)	Procedure examples in ATT&CK
Component Object Model (COM)	T1559.001	Windows	Client code calls methods on COM server objects (DLLs or EXEs) to execute code, create scheduled tasks or download and run files; DCOM extends this remotely	TrickBot and Kimsuky creating scheduled tasks through COM; InvisiMole using the ITaskService interfaces; MuddyWater malware executing through COM, DCOM and Outlook
Dynamic Data Exchange (DDE)	T1559.002	Windows	Office documents or CSV files carry DDE commands or formulas that request command execution when opened, avoiding macros	Operation Sharpshooter sending Word OLE documents; HAWKBALL using an OLE object
XPC Services	T1559.003	macOS	Malicious requests passed through an application's XPC service handler, including abuse of improper client validation or poor input sanitisation to escalate privilege (T1068)	None listed in ATT&CK v20; ATT&CK cites vulnerability research on XPC handlers
Named pipes, sockets and other IPC	T1559 (parent)	Windows, Linux, macOS	Pipes, UNIX domain sockets, Mach ports and message queues used to pass commands between components	Havoc using named pipes between demons; POWERSTATS using DCOM against the loopback address

ATT&CK states DDE was superseded by COM but may still be enabled in Windows and Office through registry keys. CSV formula abuse overlaps with the OWASP CSV Injection issue, where spreadsheet programs treat cells beginning with characters such as =, +, - or @ as formulas; applications that export CSV should neutralise those leading characters.

Detection analytics by sub-technique

ATT&CK v20 publishes four detection strategies for T1559: DET0493 for the parent, DET0224 for COM, DET0504 for DDE and DET0335 for XPC. The table summarises their analytics and the log sources ATT&CK names.

Analytic	Platform	Behaviour	Log sources named by ATT&CK
AN1393 (DDE)	Windows	WINWORD.EXE or EXCEL.EXE spawning command interpreters, unusual module loads through DDEAUTO or DDE formulas, registry keys enabling DDE	Sysmon 1 (process creation), Sysmon 7 (image loaded), Security 4656, 4663, 4670 (registry object access)
AN0628 (COM)	Windows	Office applications spawning scripting engines, enumeration of COM interfaces through registry queries, atypical DLLs loaded through COM activation	Sysmon 1, Sysmon 7, Security 4656, 4663, 4670
AN1357 (parent)	Windows	Creation or access of named pipes or COM objects alongside unusual parent and child relationships or injection patterns	Security 4656, 4663, 4670; Sysmon 17 (pipe created)
AN1358 (parent)	Linux	AF_UNIX socket creation outside expected daemons; access to named pipes or FIFOs in /tmp or /dev/shm by unexpected processes	auditd SYSCALL socket and open
AN1359 (parent)	macOS	Unusual Mach port registration between unrelated processes; unexpected osascript or AppleScript targeting sensitive applications	Unified log; osquery exec
AN0948 (XPC)	macOS	Non-Apple-signed or abnormal binaries making NSXPCConnection calls to privileged daemons; helper tools executing unexpected binaries outside their expected parent lineage	Unified log

Registry auditing events 4656, 4663 and 4670 only appear for keys that carry a SACL, so add auditing to the Office security keys you care about before relying on them. The Sysmon Guide covers process, image load and pipe event configuration.

High-value hunts

Office spawning interpreters: winword.exe, excel.exe, powerpnt.exe, outlook.exe or onenote.exe as the parent of cmd.exe, powershell.exe, mshta.exe, wscript.exe or rundll32.exe.
DDE re-enabled: changes to the Word AllowDDE value or to link update settings under the user Office keys, outside your configuration management.
COM-created scheduled tasks: a scheduled task registered by a process that is not a known management tool, with no schtasks.exe process in the tree, which points to the Task Scheduler COM interfaces.
Unexpected named pipes: pipes created by Office, browsers or user-writable binaries; baseline the pipe names your estate normally creates.
Unsigned XPC clients: on macOS, privileged helper tools receiving connections from binaries without a valid Developer ID or Apple signature.

Prevention: settings for each mechanism

DDE and OLE links in Office

Microsoft Security Advisory 4053440 recommends registry settings that turn off automatic updating of DDE and OLE links, under HKEY_CURRENT_USER\Software\Microsoft\Office\<version>. Microsoft's December 2017 Word update and January 2018 Excel update under ADV170021 then let administrators control DDE behaviour, and ATT&CK records that Microsoft created and enabled by default registry keys to disable DDE execution in Word and Excel.

Application	Key and value	Effect	Source
Word 2010 and later	Word\Options, DontUpdateLinks (DWORD) = 1	Disables automatic DDE field and OLE link updates	Advisory 4053440
Outlook 2010 and later	Word\Options\WordMail, DontUpdateLinks (DWORD) = 1	Same, for the Outlook editor	Advisory 4053440
Excel 2007 and later	Excel\Security, WorkbookLinkWarnings (DWORD) = 2	Disables automatic update of workbook links	Advisory 4053440
Word (after ADV170021)	Word\Security, AllowDDE (DWORD): 0 disables DDE, 1 allows requests only to already running programs, 2 fully allows	Controls DDE requests; 0 is the default after the update	Microsoft advisory ADV170021 (12 December 2017)

Microsoft notes the trade-off: spreadsheets fed by live links will not update automatically, so users must refresh manually. Deploy these values through Group Policy or your device management tool and confirm the current names against Microsoft's documentation for your Office channel.

Office execution controls

Protected View: ATT&CK lists keeping Protected View and COM alerts enabled as a mitigation (M1048). Microsoft's documentation says files from the internet, unsafe locations and failed file validation open in Protected View, and administrators can stop users leaving it.
Attack surface reduction: ATT&CK lists ASR rules as a mitigation (M1040). Relevant Microsoft Defender rules include "Block all Office applications from creating child processes" (d4f940ab-401b-4efc-aadc-ad5f3c50688a), "Block Office applications from injecting code into other processes" (75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84) and "Block Win32 API calls from Office macros" (92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b). Start in audit mode.
Embedded files: ATT&CK suggests disabling embedded files in Office programs, such as OneNote, that do not work with Protected View (M1054). See the OneNote Malware Delivery Guide.

COM security

ATT&CK's M1026 guidance for T1559.001 is to set process-wide security for individual COM applications under HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{AppID_GUID}, and system-wide defaults for applications that set none under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole, either directly or with Dcomcnfg.exe. Restrict launch and activation permissions to the accounts that need them, and disable DCOM where it is not required. Industrial estates should also read the OPC Classic and DCOM Hardening Guide.

XPC and macOS helpers

ATT&CK's M1013 guidance is for developers to enable the Hardened Runtime and not ship the com.apple.security.get-task-allow entitlement set to true. Apple's documentation says the Hardened Runtime, with System Integrity Protection, prevents classes of exploits such as code injection, library hijacking and process memory tampering, and is required for notarisation. For buyers and administrators, that means: prefer notarised software, inventory privileged helper tools in /Library/PrivilegedHelperTools, remove helpers for uninstalled apps, and apply vendor updates for helpers promptly. See the macOS Security Guide for Enterprises.

Implementing T1559 coverage

Baseline (week 1): collect 30 days of Office child processes, named pipe creation and scheduled task registrations; list legitimate add-ins and tools that use COM or DDE.
Audit-mode controls (weeks 2 to 4): enable the Office ASR rules in audit mode and deploy the DDE and link registry values to a pilot ring that includes finance users who rely on linked workbooks.
Deploy analytics (weeks 2 to 4): implement the AN1393 and AN0628 logic and the hunts above, alerting first on Office spawning interpreters.
Enforce (weeks 5 to 8): move ASR rules to block, extend the registry values estate-wide, and add exclusions only for named, documented business processes.
macOS (in parallel): inventory privileged helper tools and enable unified log collection for XPC events on managed Macs.
Roll back: ASR rules can be set back to audit per rule, and registry values reverted through the same policy, if a critical workflow breaks.

Smaller organisations can get most of the protection from the registry values, Protected View and ASR rules without building custom analytics. Larger estates with heavy Excel automation should expect to manage exceptions and should test link-dependent workbooks before enforcing.

Responding to suspected IPC abuse

Find the document or source: identify the file that the Office process had open, its origin (email, download, share) and every other recipient.
Trace children and artefacts: follow the process tree, including scheduled tasks created through COM and pipes opened by the payload.
Contain: isolate the host if a payload ran, block the file hash and sender, and purge the document from mailboxes.
Remove persistence: delete scheduled tasks and COM registrations the payload created; check for related techniques such as COM hijacking under the T1546 Event Triggered Execution Defensive Guide.
Preserve evidence: keep the document, process tree, registry changes and pipe names before cleaning the host.

Measuring it

ASR enforcement: percentage of Windows endpoints with the Office child process rule in block mode.
DDE configuration compliance: percentage of Office installations with the link and DDE registry values set as policy.
Office child process alerts: weekly count of Office applications spawning interpreters, split into blocked, allowed by exception and investigated.
Helper tool inventory: number of privileged helper tools on managed Macs that belong to unapproved or uninstalled software (target zero).
Time to purge: time from a confirmed malicious document to removal from all mailboxes.

Common failure patterns

Macro blocking treated as complete: VBA macros are blocked from the internet, but DDE fields and CSV formulas still run.
Exclusions for whole applications: an ASR exclusion for excel.exe added to fix one workbook, which removes protection for every spreadsheet.
Registry auditing with no SACL: rules that rely on 4663 for Office keys that were never audited.
Ignoring COM-created tasks: monitoring schtasks.exe command lines but not scheduled tasks registered through the COM interface.
Orphaned macOS helpers: privileged helper tools left behind after apps are removed, still listening for XPC connections.

Framework mapping

Framework	Reference	How it applies
MITRE ATT&CK v20	T1559, T1559.001, T1559.002, T1559.003; DET0493, DET0224, DET0504, DET0335	The technique, sub-techniques and detection strategies
MITRE ATT&CK v20	M1042, M1040, M1054, M1048, M1026, M1013	Disable features, endpoint behaviour prevention, software configuration, sandboxing, privileged account management, developer guidance
NIST SP 800-53 Rev. 5	CM-6 Configuration Settings, CM-7 Least Functionality, SI-3 Malicious Code Protection, SI-4 System Monitoring	Enforce Office and COM settings, remove unused features, block and detect malicious documents
NIST CSF 2.0	PR.PS-01, DE.CM-09	Configuration management practices are applied; computing environments are monitored

Practitioner checklist

Set DontUpdateLinks, WorkbookLinkWarnings and AllowDDE through policy, after piloting with link-heavy users.
Keep Protected View on for internet files, unsafe locations and attachments, and stop users leaving it where possible.
Enforce the Office child process, code injection and Win32 API ASR rules after an audit period.
Alert on Office applications spawning interpreters and on scheduled tasks created outside known tools.
Restrict COM launch and activation permissions and disable DCOM where unused.
Neutralise leading formula characters in any CSV your applications export.
Inventory and prune macOS privileged helper tools; prefer notarised software.
Collect Sysmon pipe events and baseline normal pipe names.

MITRE ATT&CK T1559 Inter-Process Communication: Detecting COM, DDE and XPC Abuse