Inter-Process Communication `T1559`

Tactic: Execution

Adversaries may abuse inter-process communication (IPC) mechanisms for local code or command execution. IPC is typically used by processes to share data, communicate with each other, or synchronize execution. IPC is also commonly used to avoid situations such as deadlocks, which occurs when processes are stuck in a cyclic waiting pattern.

Events covered

14 catalog events are tagged with this technique by at least one rule.

Provider	Event	Title
Sysmon	Event ID 1	Process creation
Sysmon	Event ID 3	Network connection
Sysmon	Event ID 7	Image loaded
Sysmon	Event ID 10	ProcessAccess
Sysmon	Event ID 11	FileCreate
Sysmon	Event ID 13	RegistryEvent (Value Set)
Sysmon	Event ID 17	PipeEvent (Pipe Created)
Sysmon	Event ID 18	PipeEvent (Pipe Connected)
Sysmon	Event ID 22	DNSEvent (DNS query)
Security-Auditing	Event ID 4688	A new process has been created.
Defender-DeviceEvents	any	Defender event
Defender-DeviceEvents	NamedPipeEvent	Named pipe event
ESF	exec	Process Execution
ESF	xpc_connect	XPC Service Connection

Authoring guide

These 38 rules share fields, values, and exclusions.

Fields filtered most (42 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`event.type`	15	`eq` 15	`start`
`process_basename`	15	`eq` 13, `in` 2, `wildcard` 2	`cscript.exe`, `curl`, `cmd.exe`, `mshta.exe`, `nscurl`
`EventType`	13	`eq` 9, `in` 3, `starts_with` 1	`start`, `exec`, `exec_event`, `xpc_connect`, `ConnectPipe`
`parent_process_basename`	11	`eq` 9, `in` 1, `starts_with` 1	`dllhost.exe`, `explorer.exe`, `bash`, `com.*`, `dbus-daemon`
`Image`	10	`ends_with` 4, `wildcard` 3, `starts_with` 2, `is_not_null` 1	`/Applications/`, `\regsvr32.exe`, , `/Library/Application Support/`, `/Users//Library/`
`process.args`	6	`eq` 6, `starts_with` 2, `wildcard` 1	`-`, `--abstract-unix-socket`, `--unix-socket`, `-CLSID:{0002DF01-0000-0000-C000-000000000046}`, `-Embedding`
`EventID`	5	`eq` 3, `in` 2	`17`, `18`
`Initiated`	5	`eq` 5	`incoming`, `ingress`, `true`
`process.code_signature.exists`	5	`eq` 5	`false`
`process.code_signature.trusted`	5	`eq` 5	`false`
`process.parent.args`	5	`eq` 4, `in` 1	`-Embedding`, `/Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}`, `/Processid:{BD54C901-076B-434E-B6C7-17C531F4AB41}`, `/Processid:{D2E7041B-2927-42FB-8E9F-7CE93B6DC937}`
`OriginalFileName`	4	`eq` 2, `in` 1, `ne` 1	`Cmd.Exe`, `MSHTA.EXE`, `PowerShell.EXE`, `WerFault.exe`, `cscript.exe`
`tool`	4	`is_not_null` 4
`DestinationPort`	3	`gt` 2, `ge` 1	`49151`, `49152`
`ParentImage`	3	`ends_with` 1, `eq` 1, `starts_with` 1	`/System/Library/CoreServices/Installer.app/Contents/XPCSe...`, `/sbin/launchd`, `\rundll32.exe`

Top indicator values (227 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`event.type`	`eq`	`start` elasticExecution of COM object via Xwizard elasticIncoming DCOM Lateral Movement via MSHTA elasticIncoming DCOM Lateral Movement with MMC elasticIncoming DCOM Lateral Movement with ShellBrowserWindow or ShellWindows elasticPotential Command and Control via Internet Explorer elasticSuspicious Explorer Child Process elasticSuspicious Installer Remote Plugin Service Child Process elasticSuspicious XPC Service Child Process elasticUAC Bypass Attempt via Elevated COM Internet Explorer Add-On Installer elasticUAC Bypass Attempt with IEditionUpgradeManager Elevated COM Interface elasticUAC Bypass via ICMLuaUtil Elevated COM Interface elasticUnix Socket Connection elasticUnsigned or Untrusted Application Launch via XPC elasticUnsigned or Untrusted Binary Execution via XPC call elasticUnusual D-Bus Daemon Child Process	15	1036
`process.code_signature.exists`	`eq`	`false` elasticFile Cloned by Unsigned or Untrusted Process elasticSuspicious Inter-Process Communication via Outlook elasticSuspicious Windows Component Object Model via DLLHOST elasticUnsigned or Untrusted Application Launch via XPC elasticUnsigned or Untrusted Binary Execution via XPC call	5	118
`process.code_signature.trusted`	`eq`	`false` elasticFile Cloned by Unsigned or Untrusted Process elasticSuspicious Inter-Process Communication via Outlook elasticSuspicious Windows Component Object Model via DLLHOST elasticUnsigned or Untrusted Application Launch via XPC elasticUnsigned or Untrusted Binary Execution via XPC call	5	114
`process_basename`	`eq`	`mshta.exe` elasticIncoming DCOM Lateral Movement via MSHTA elasticSuspicious Command and Control via Internet Explorer elasticSuspicious Explorer Child Process elasticSuspicious Inter-Process Communication via Outlook elasticSuspicious Windows Component Object Model via DLLHOST	5	84
`process_basename`	`eq`	`regsvr32.exe` elasticPotential Command and Control via Internet Explorer elasticSuspicious Command and Control via Internet Explorer elasticSuspicious Explorer Child Process elasticSuspicious Inter-Process Communication via Outlook elasticSuspicious Windows Component Object Model via DLLHOST	5	74
`process_basename`	`eq`	`rundll32.exe` elasticPotential Command and Control via Internet Explorer elasticSuspicious Command and Control via Internet Explorer elasticSuspicious Explorer Child Process elasticSuspicious Inter-Process Communication via Outlook elasticSuspicious Windows Component Object Model via DLLHOST	5	123
`process_basename`	`eq`	`cscript.exe` elasticSuspicious Command and Control via Internet Explorer elasticSuspicious Explorer Child Process elasticSuspicious Inter-Process Communication via Outlook elasticSuspicious Windows Component Object Model via DLLHOST	4	68
`process_basename`	`eq`	`powershell.exe` elasticSuspicious Command and Control via Internet Explorer elasticSuspicious Explorer Child Process elasticSuspicious Inter-Process Communication via Outlook elasticSuspicious Windows Component Object Model via DLLHOST	4	187
`process_basename`	`eq`	`wscript.exe` elasticSuspicious Command and Control via Internet Explorer elasticSuspicious Explorer Child Process elasticSuspicious Inter-Process Communication via Outlook elasticSuspicious Windows Component Object Model via DLLHOST	4	84
`process_basename`	`eq`	`EXCEL.EXE` elasticRemote XSL Script Execution via COM elasticSuspicious Image Load (taskschd.dll) from MS Office elasticSuspicious Windows Component Object Model via DLLHOST	3	34
`process_basename`	`eq`	`POWERPNT.EXE` elasticRemote XSL Script Execution via COM elasticSuspicious Image Load (taskschd.dll) from MS Office elasticSuspicious Windows Component Object Model via DLLHOST	3	31
`process_basename`	`eq`	`WINWORD.EXE` elasticRemote XSL Script Execution via COM elasticSuspicious Image Load (taskschd.dll) from MS Office elasticSuspicious Windows Component Object Model via DLLHOST	3	35
`EventType`	`eq`	`start` elasticRemote XSL Script Execution via COM elasticSuspicious Command and Control via Internet Explorer elasticSuspicious Inter-Process Communication via Outlook elasticSuspicious Windows Component Object Model via DLLHOST	4	388
`EventType`	`eq`	`exec` elasticSuspicious Installer Remote Plugin Service Child Process elasticUnsigned or Untrusted Binary Execution via XPC call	2	547
`EventType`	`eq`	`xpc_connect` sigmaConnection to Suspicious XPC Service sigmaXPC Connection from Unusual Location	2	3
`tool`	`is_not_null`	splunkWindows PUA Named Pipe splunkWindows RMM Named Pipe splunkWindows Suspicious C2 Named Pipe splunkWindows Suspicious Named Pipe	4	8
`EventID`	`eq`	`17` splunkWindows PUA Named Pipe splunkWindows RMM Named Pipe splunkWindows Suspicious C2 Named Pipe	3	4
`EventID`	`eq`	`18` splunkWindows PUA Named Pipe splunkWindows RMM Named Pipe splunkWindows Suspicious C2 Named Pipe	3	4
`Initiated`	`eq`	`incoming` elasticIncoming DCOM Lateral Movement via MSHTA elasticIncoming DCOM Lateral Movement with MMC elasticIncoming DCOM Lateral Movement with ShellBrowserWindow or ShellWindows	3	10
`Initiated`	`eq`	`ingress` elasticIncoming DCOM Lateral Movement via MSHTA elasticIncoming DCOM Lateral Movement with MMC elasticIncoming DCOM Lateral Movement with ShellBrowserWindow or ShellWindows	3	12
`Protocol`	`eq`	`tcp` elasticIncoming DCOM Lateral Movement via MSHTA elasticIncoming DCOM Lateral Movement with MMC elasticIncoming DCOM Lateral Movement with ShellBrowserWindow or ShellWindows	3	16
`process.parent.args`	`eq`	`-Embedding` elasticPotential Command and Control via Internet Explorer elasticSuspicious Explorer Child Process elasticUAC Bypass Attempt via Elevated COM Internet Explorer Add-On Installer	3	7
`src_ip`	`ne`	`127.0.0.1` elasticIncoming DCOM Lateral Movement via MSHTA elasticIncoming DCOM Lateral Movement with MMC elasticIncoming DCOM Lateral Movement with ShellBrowserWindow or ShellWindows	3	22
`src_ip`	`ne`	`::1` elasticIncoming DCOM Lateral Movement via MSHTA elasticIncoming DCOM Lateral Movement with MMC elasticIncoming DCOM Lateral Movement with ShellBrowserWindow or ShellWindows	3	20
`DestinationPort`	`gt`	`49151` elasticIncoming DCOM Lateral Movement via MSHTA elasticIncoming DCOM Lateral Movement with ShellBrowserWindow or ShellWindows	2	2
`EventID`	`in`	`17` splunkWindows Anonymous Pipe Activity splunkWindows Suspicious Named Pipe	2	6
`EventID`	`in`	`18` splunkWindows Anonymous Pipe Activity splunkWindows Suspicious Named Pipe	2	6
`EventType`	`in`	`exec` elasticUnix Socket Connection elasticUnusual D-Bus Daemon Child Process	2	180
`EventType`	`in`	`exec_event` elasticUnix Socket Connection elasticUnusual D-Bus Daemon Child Process	2	135
`EventType`	`in`	`start` elasticUnix Socket Connection elasticUnusual D-Bus Daemon Child Process	2	157

Exclusions (188 distinct)

These values appear most often in top-level exclusions.

Field	Kind	Value	Rules excluding
`process_name`	`in`	`:\Program Files \(x86\)\Adobe` splunkWindows PUA Named Pipe splunkWindows RMM Named Pipe splunkWindows Suspicious C2 Named Pipe splunkWindows Suspicious Named Pipe	4
`process_name`	`in`	`:\Program Files \(x86\)\Google` splunkWindows PUA Named Pipe splunkWindows RMM Named Pipe splunkWindows Suspicious C2 Named Pipe splunkWindows Suspicious Named Pipe	4
`process_name`	`in`	`:\Program Files \(x86\)\Microsoft` splunkWindows PUA Named Pipe splunkWindows RMM Named Pipe splunkWindows Suspicious C2 Named Pipe splunkWindows Suspicious Named Pipe	4
`process_name`	`in`	`:\Program Files\Adobe` splunkWindows PUA Named Pipe splunkWindows RMM Named Pipe splunkWindows Suspicious C2 Named Pipe splunkWindows Suspicious Named Pipe	4
`process_name`	`in`	`:\Program Files\Google` splunkWindows PUA Named Pipe splunkWindows RMM Named Pipe splunkWindows Suspicious C2 Named Pipe splunkWindows Suspicious Named Pipe	4
`process_name`	`in`	`:\Program Files\Microsoft` splunkWindows PUA Named Pipe splunkWindows RMM Named Pipe splunkWindows Suspicious C2 Named Pipe splunkWindows Suspicious Named Pipe	4
`process_name`	`in`	`*:\Windows\System32\svchost.exe` splunkWindows PUA Named Pipe splunkWindows RMM Named Pipe splunkWindows Suspicious C2 Named Pipe splunkWindows Suspicious Named Pipe	4
`process_name`	`in`	`:\Windows\SystemApps\Microsoft` splunkWindows PUA Named Pipe splunkWindows RMM Named Pipe splunkWindows Suspicious C2 Named Pipe splunkWindows Suspicious Named Pipe	4
`process_name`	`in`	`*:\Windows\system32\SearchIndexer.exe` splunkWindows PUA Named Pipe splunkWindows RMM Named Pipe splunkWindows Suspicious C2 Named Pipe splunkWindows Suspicious Named Pipe	4
`process_name`	`in`	`\Amazon\SSM\Instance` splunkWindows PUA Named Pipe splunkWindows RMM Named Pipe splunkWindows Suspicious C2 Named Pipe splunkWindows Suspicious Named Pipe	4
`process_name`	`in`	`\AppData\Local\Google` splunkWindows PUA Named Pipe splunkWindows RMM Named Pipe splunkWindows Suspicious C2 Named Pipe splunkWindows Suspicious Named Pipe	4
`process_name`	`in`	`\AppData\Local\Kingsoft\` splunkWindows PUA Named Pipe splunkWindows RMM Named Pipe splunkWindows Suspicious C2 Named Pipe splunkWindows Suspicious Named Pipe	4
`process_name`	`in`	`\AppData\Local\Microsoft` splunkWindows PUA Named Pipe splunkWindows RMM Named Pipe splunkWindows Suspicious C2 Named Pipe splunkWindows Suspicious Named Pipe	4
`process_name`	`in`	`System` splunkWindows PUA Named Pipe splunkWindows RMM Named Pipe splunkWindows Suspicious C2 Named Pipe splunkWindows Suspicious Named Pipe	4
`process.args`	`starts_with`	`?:\Program Files (x86)\*` elasticSuspicious Command and Control via Internet Explorer elasticSuspicious Windows Component Object Model via DLLHOST	2

Inter-Process Communication `T1559`

Events covered

Authoring guide

Fields filtered most (42 distinct)

Top indicator values (227 distinct)

Exclusions (188 distinct)

Rules under this technique

Sigma 9 rules

Elastic 21 rules

Splunk 6 rules

Kusto 2 rules

Inter-Process Communication T1559

Events covered

Authoring guide

Fields filtered most (42 distinct)

Top indicator values (227 distinct)

Exclusions (188 distinct)

Rules under this technique

Sigma 9 rules

Elastic 21 rules

Splunk 6 rules

Kusto 2 rules

Inter-Process Communication `T1559`