Skip to content

Inter-Process Communication

Technique · ATTACK:enterprise:T1559

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1559",
  "title": "Inter-Process Communication",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1559",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--acd0ba37-7ba9-4cc5-ac61-796586cd856d",
  "external_id": "T1559",
  "domain": "enterprise",
  "created": "2020-02-12T14:08:48.689Z",
  "modified": "2026-05-12T15:12:00.707Z",
  "version": "1.4",
  "aliases": [

  ],
  "tactics": [
    "execution"
  ],
  "source_references": [
    {
      "source_name": "Fireeye Hunting COM June 2019",
      "url": "https://www.fireeye.com/blog/threat-research/2019/06/hunting-com-objects.html"
    },
    {
      "source_name": "Linux IPC",
      "url": "https://www.geeksforgeeks.org/inter-process-communication-ipc/#:~:text=Inter%2Dprocess%20communication%20(IPC),of%20co%2Doperation%20between%20them."
    }
  ]
}

Explicit source assertions (28)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:M1042 → mitigates → ATTACK:enterprise:T1559

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--16f46969-91e3-4bcd-8d58-97e88e6b1d3e

Microsoft DDE Advisory Nov 2017 · BleepingComputer DDE Disabled in Word Dec 2017 · GitHub Disable DDEAUTO Oct 2017 · Microsoft ADV170021 Dec 2017

ATTACK:enterprise:S1229 → uses → ATTACK:enterprise:T1559

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--22f3b02d-e475-4d42-b4ae-b63da598e060

Havoc Framework Documentation

ATTACK:enterprise:S1200 → uses → ATTACK:enterprise:T1559

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--27e71f08-221a-47cf-a583-b32c2db001ee

Cybereason StealBit Exfiltration Tool

ATTACK:enterprise:S1130 → uses → ATTACK:enterprise:T1559

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2f1cb78e-3859-4e7f-976e-ddb791ffdad3

TrendMicro RaspberryRobin 2022

ATTACK:enterprise:S9062 → uses → ATTACK:enterprise:T1559

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--32ebbca7-d489-4810-a129-6019dccf42a0

CheckPoint_NimbusManticoreEurope_Sept2025

ATTACK:enterprise:C0048 → uses → ATTACK:enterprise:T1559

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--33fd0362-64e8-4d21-b279-1ac4c8143f31

Volexity UPSTYLE 2024

ATTACK:enterprise:M1054 → mitigates → ATTACK:enterprise:T1559

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--39a3fc74-012e-47fc-b806-d9267a0f54ba

Enigma Reviving DDE Jan 2018 · GitHub Disable DDEAUTO Oct 2017

ATTACK:enterprise:C0057 → uses → ATTACK:enterprise:T1559

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--42f40187-5451-4bf4-96e8-d15de1f395c8

Mandiant 3cx UNC4736 2023

ATTACK:enterprise:S1150 → uses → ATTACK:enterprise:T1559

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--54607e53-5952-47f1-bffa-72379bbf58c8

Mandiant ROADSWEEP August 2022

ATTACK:enterprise:S1123 → uses → ATTACK:enterprise:T1559

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5a094c68-b8cd-470b-a4ff-11109fd0b309

Mandiant Cutting Edge Part 3 February 2024

ATTACK:enterprise:S0022 → uses → ATTACK:enterprise:T1559

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--70efcdd6-80c3-4f95-981b-4da24639f32b

Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023

ATTACK:enterprise:M1048 → mitigates → ATTACK:enterprise:T1559

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--73c6ad27-074a-437d-82ec-39592b783160

Microsoft Protected View

ATTACK:enterprise:S0537 → uses → ATTACK:enterprise:T1559

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--82fa754d-3c73-415f-9bc3-3e6be5458856

Accenture HyperStack October 2020

ATTACK:enterprise:T1559.003 → subtechnique-of → ATTACK:enterprise:T1559

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--899f5d50-95bf-47e6-a95a-cb6e46a4c9bd

ATTACK:enterprise:S1172 → uses → ATTACK:enterprise:T1559

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8f2f514a-81be-4f14-be6f-d442814b9bd6

ESET OilRig Downloaders DEC 2023

ATTACK:enterprise:T1559.002 → subtechnique-of → ATTACK:enterprise:T1559

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--99994a2f-c6d3-4766-92e4-b8d1e62e8aa4

ATTACK:enterprise:S1244 → uses → ATTACK:enterprise:T1559

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9d753094-3f5a-4d38-88dd-13289e1d8318

Security Scorecard Medusa Ransomware January 2024

ATTACK:enterprise:S9024 → uses → ATTACK:enterprise:T1559

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a65e797a-d529-427b-82aa-33edf4ead0a2

Google UNC5221 BRICKSTORM SPAWNCHIMERA April 2024 · JPCERT SPAWNCHIMERA Ivanti February 2025

ATTACK:enterprise:S0687 → uses → ATTACK:enterprise:T1559

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--aba4b49c-0e87-4e81-81ce-cdefff278c5f

Trend Micro Cyclops Blink March 2022

ATTACK:enterprise:M1026 → mitigates → ATTACK:enterprise:T1559

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c111033c-3544-43b8-9168-32590659557d

Microsoft Process Wide Com Keys · Microsoft System Wide Com Keys · Microsoft COM ACL

ATTACK:enterprise:T1559.001 → subtechnique-of → ATTACK:enterprise:T1559

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c9005a9a-c6c5-4044-82d7-f108b2e72f93

ATTACK:enterprise:M1040 → mitigates → ATTACK:enterprise:T1559

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ca928ba4-bb4b-4cd9-a105-8c0d4d81891f

Microsoft ASR Nov 2017 · Enigma Reviving DDE Jan 2018

ATTACK:enterprise:S9043 → uses → ATTACK:enterprise:T1559

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d3e1a3fd-c00a-47b5-9a51-29546f6519e3

Hunt.io TeamPCP Toolkit MAY 2026 · Trend Micro TeamPCP MAY 2026

ATTACK:enterprise:S1078 → uses → ATTACK:enterprise:T1559

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d5b2d34f-5650-4fb3-bacf-2b1765943bfe

RotaJakiro 2021 netlab360 analysis

ATTACK:enterprise:S1141 → uses → ATTACK:enterprise:T1559

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dc815cae-8024-469b-b801-5d187ffeca81

ESET Turla Lunar toolset May 2024

ATTACK:enterprise:S1100 → uses → ATTACK:enterprise:T1559

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e4d5f735-1629-48f8-9728-f76adf586a0b

Kaspersky ToddyCat June 2022

ATTACK:enterprise:S1239 → uses → ATTACK:enterprise:T1559

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ec6b9512-b23a-4aac-87b8-b5c4c19493de

2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA · Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023

ATTACK:enterprise:M1013 → mitigates → ATTACK:enterprise:T1559

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f60e5a0d-cfdf-4c4e-be35-af5a2bdbc131

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.