T1559
About this technique
Adversaries may abuse inter-process communication (IPC) mechanisms for local code or command execution. IPC is typically used by processes to share data, communicate with each other, or synchronize execution. IPC is also commonly used to avoid situations such as deadlocks, which occurs when processes are stuck in a cyclic waiting pattern.
Read the full ATT&CK description
Adversaries may abuse IPC to execute arbitrary code or commands. IPC mechanisms may differ depending on OS, but typically exists in a form accessible through programming languages/libraries or native interfaces such as Windows Dynamic Data Exchange or Component Object Model.
Linux environments support several different IPC mechanisms, two of which being sockets and pipes.(Citation: Linux IPC) Higher level execution mediums, such as those of Command and Scripting Interpreters, may also leverage underlying IPC mechanisms.
Adversaries may also use Remote Services such as Distributed Component Object Model to facilitate remote IPC execution.(Citation: Fireeye Hunting COM June 2019)
Curated incident relationships
These associations come from maintained incident records. The recorded confidence is shown when the source record provides it.
Daily items linked through predicted CVEs
A Daily item appears here when it mentions a CVE whose triage artifact predicts this technique. This is not a verified ATT&CK mapping.
Predicted CVE associations
These backfilled or model-produced candidates come from the current triage artifact. They are informational, not official MITRE mappings.