Dynamic Data Exchange
Subtechnique · ATTACK:enterprise:T1559.002
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1559.002",
"title": "Dynamic Data Exchange",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1559/002",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--232a7e42-cd6e-4902-8fe9-2960f529dd4d",
"external_id": "T1559.002",
"domain": "enterprise",
"created": "2020-02-12T14:10:50.699Z",
"modified": "2025-10-24T17:48:31.581Z",
"version": "1.4",
"aliases": [
],
"tactics": [
"execution"
],
"source_references": [
{
"source_name": "OWASP CSV Injection",
"url": "https://owasp.org/www-community/attacks/CSV_Injection"
},
{
"source_name": "CSV Excel Macro Injection ",
"url": "https://blog.securelayer7.net/how-to-perform-csv-excel-macro-injection/"
},
{
"source_name": "BleepingComputer DDE Disabled in Word Dec 2017",
"url": "https://www.bleepingcomputer.com/news/microsoft/microsoft-disables-dde-feature-in-word-to-prevent-further-malware-attacks/"
},
{
"source_name": "SensePost PS DDE May 2016",
"url": "https://sensepost.com/blog/2016/powershell-c-sharp-and-dde-the-power-within/"
},
{
"source_name": "Fireeye Hunting COM June 2019",
"url": "https://www.fireeye.com/blog/threat-research/2019/06/hunting-com-objects.html"
},
{
"source_name": "Kettle CSV DDE Aug 2014",
"url": "https://www.contextis.com/blog/comma-separated-vulnerabilities"
},
{
"source_name": "Microsoft ADV170021 Dec 2017",
"url": "https://portal.msrc.microsoft.com/security-guidance/advisory/ADV170021"
},
{
"source_name": "Microsoft DDE Advisory Nov 2017",
"url": "https://technet.microsoft.com/library/security/4053440"
},
{
"source_name": "Enigma Reviving DDE Jan 2018",
"url": "https://posts.specterops.io/reviving-dde-using-onenote-and-excel-for-code-execution-d7226864caee"
},
{
"source_name": "NVisio Labs DDE Detection Oct 2017",
"url": "https://blog.nviso.be/2017/10/11/detecting-dde-in-ms-office-documents/"
},
{
"source_name": "SensePost MacroLess DDE Oct 2017",
"url": "https://sensepost.com/blog/2017/macro-less-code-exec-in-msword/"
}
]
}Explicit source assertions (25)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0458 → uses → ATTACK:enterprise:T1559.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0709589f-cc25-4925-89be-59e121c47951
Eset Ramsay May 2020ATTACK:enterprise:C0013 → uses → ATTACK:enterprise:T1559.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--14acc004-9b77-4a4a-b31d-a8eea459b4bb
McAfee Sharpshooter December 2018ATTACK:enterprise:S0391 → uses → ATTACK:enterprise:T1559.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--160a52b3-8acd-4f19-810f-ac4ce96319d3
FireEye HAWKBALL Jun 2019ATTACK:enterprise:M1040 → mitigates → ATTACK:enterprise:T1559.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--38482de7-5eb7-4baf-9007-2e1a6efe9622
Microsoft ASR Nov 2017 · Enigma Reviving DDE Jan 2018ATTACK:enterprise:G0080 → uses → ATTACK:enterprise:T1559.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4bfaaf99-6884-4df1-af72-0cc61ce50aa0
Talos Cobalt Group July 2018ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1559.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--51afbe4e-c5cd-4acd-b4e1-ff7877b78b9e
CyberScoop FIN7 Oct 2017ATTACK:enterprise:G0069 → uses → ATTACK:enterprise:T1559.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5ac271fa-d3a7-40a6-8862-3eb73331ae99
Securelist MuddyWater Oct 2018ATTACK:enterprise:G0121 → uses → ATTACK:enterprise:T1559.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--67583965-9e89-49cd-bdac-9fd69d7857ae
Rewterz Sidewinder APT April 2020 · Rewterz Sidewinder COVID-19 June 2020ATTACK:enterprise:S0148 → uses → ATTACK:enterprise:T1559.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6975d10a-91bf-4a22-8353-745de444c594
ESET RTM Feb 2017ATTACK:enterprise:G0007 → uses → ATTACK:enterprise:T1559.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--69f57458-bfb2-44a2-a8cf-0fce0e2b0a22
McAfee APT28 DDE1 Nov 2017 · McAfee APT28 DDE2 Nov 2017 · Palo Alto Sofacy 06-2018ATTACK:enterprise:S0476 → uses → ATTACK:enterprise:T1559.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6bc33571-c702-4fcc-9f1c-b87d5a842586
SentinelOne Valak June 2020ATTACK:enterprise:S0428 → uses → ATTACK:enterprise:T1559.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7ed3bfbd-41a7-46c4-acf7-43330dd50784
Talos PoetRAT April 2020ATTACK:enterprise:G0067 → uses → ATTACK:enterprise:T1559.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7fe2431d-30b9-45ef-8857-ecef17e428a9
Securelist ScarCruft Jun 2016ATTACK:enterprise:S0223 → uses → ATTACK:enterprise:T1559.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--84a213fc-604f-441f-ba18-feab32085a50
FireEye MuddyWater Mar 2018ATTACK:enterprise:M1048 → mitigates → ATTACK:enterprise:T1559.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--95966f14-9a22-42ab-910d-80f108dd08de
Microsoft Protected ViewATTACK:enterprise:M1054 → mitigates → ATTACK:enterprise:T1559.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9912d67b-153f-428e-9751-e6c09c8de945
Enigma Reviving DDE Jan 2018 · GitHub Disable DDEAUTO Oct 2017ATTACK:enterprise:T1559.002 → subtechnique-of → ATTACK:enterprise:T1559
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--99994a2f-c6d3-4766-92e4-b8d1e62e8aa4
ATTACK:enterprise:G0084 → uses → ATTACK:enterprise:T1559.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9d82ba74-8cfa-4f6c-a1a0-f23fe8a738cf
Symantec Gallmaker Oct 2018ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1559.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ad4a2d0b-a268-4334-903c-153858088138
Accenture MUDCARP March 2019ATTACK:enterprise:G1002 → uses → ATTACK:enterprise:T1559.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b0994eea-4c0c-42d3-8d68-0acb1b6bb592
Cisco Talos Bitter Bangladesh May 2022ATTACK:enterprise:S0387 → uses → ATTACK:enterprise:T1559.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b71738d0-d96e-4508-9820-ece76386903c
PWC KeyBoys Feb 2017ATTACK:enterprise:S0237 → uses → ATTACK:enterprise:T1559.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c49b5147-f60f-43d7-b119-52b1761002af
Talos GravityRATATTACK:enterprise:M1042 → mitigates → ATTACK:enterprise:T1559.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--df52b929-6b31-48da-a21f-70b799e730d3
Microsoft DDE Advisory Nov 2017 · BleepingComputer DDE Disabled in Word Dec 2017 · GitHub Disable DDEAUTO Oct 2017 · Microsoft ADV170021 Dec 2017ATTACK:enterprise:G0092 → uses → ATTACK:enterprise:T1559.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f0e944fa-6dba-47c3-920a-cf7bad2d3bc5
Proofpoint TA505 June 2018ATTACK:enterprise:G0040 → uses → ATTACK:enterprise:T1559.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f7a4bc28-8f50-4e9e-9986-b71f21528967
TrendMicro Patchwork Dec 2017