T1559 Inter-Process Communication
Adversaries may abuse inter-process communication (IPC) mechanisms for local code or command execution. IPC is typically used by processes to share data, communicate with each other, or synchronize execution. IPC is also commonly used to avoid situations such as deadlocks, which occurs when processes are stuck in a cyclic waiting pattern. Adversaries may abuse IPC to execute arbitrary code or…
Who uses it · with stories on Jábega
Sigma rules to hunt it
- CMSTP Execution Process Accesshighstable · windows
- Trickbot Malware Activityhighstable · windows
- DNS Query Request By Regsvr32.EXEmediumtest · windows
- Enable Microsoft Dynamic Data Exchangemediumtest · windows
- Network Connection Initiated By Regsvr32.EXEmediumtest · windows
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.