MITRE ATT&CK technique · Execution

`T1559.002` Dynamic Data Exchange

Sub-technique of T1559 Inter-Process Communication

Adversaries may use Windows Dynamic Data Exchange (DDE) to execute arbitrary commands. DDE is a client-server protocol for one-time and/or continuous inter-process communication (IPC) between applications. Once a link is established, applications can autonomously exchange transactions consisting of strings, warm data links (notifications when a data item changes), hot data links (duplications of…

MITRE ATT&CK page ↗

Who uses it · with stories on Jábega

APT28

Sigma rules to hunt it

Enable Microsoft Dynamic Data Exchangemediumtest · windows

Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.