{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1559","id":"T1559","name":"Inter-Process Communication","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1559","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"3a548993399869c8815f31c7863d145ac6efddd4ca79c287e1823ac6e8e144f1","description":"Adversaries may abuse inter-process communication (IPC) mechanisms for local code or command execution. IPC is typically used by processes to share data, communicate with each other, or synchronize execution. IPC is also commonly used to avoid situations such as deadlocks, which occurs when processes are stuck in a cyclic waiting pattern. \n\nAdversaries may abuse IPC to execute arbitrary code or commands. IPC mechanisms may differ depending on OS, but typically exists in a form accessible through programming languages/libraries or native interfaces such as Windows [Dynamic Data Exchange](https://attack.mitre.org/techniques/T1559/002) or [Component Object Model](https://attack.mitre.org/techniques/T1559/001). Linux environments support several different IPC mechanisms, two of which being sockets and pipes.(Citation: Linux IPC) Higher level execution mediums, such as those of [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059)s, may also leverage underlying IPC mechanisms. Adversaries may also use [Remote Services](https://attack.mitre.org/techniques/T1021) such as [Distributed Component Object Model](https://attack.mitre.org/techniques/T1021/003) to facilitate remote IPC execution.(Citation: Fireeye Hunting COM June 2019)","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1559","external_id":"T1559"},{"source_name":"Fireeye Hunting COM June 2019","description":"Hamilton, C. (2019, June 4). Hunting COM Objects. Retrieved June 10, 2019.","url":"https://www.fireeye.com/blog/threat-research/2019/06/hunting-com-objects.html"},{"source_name":"Linux IPC","description":"N/A. (2021, April 1). Inter Process Communication (IPC). Retrieved March 11, 2022.","url":"https://www.geeksforgeeks.org/inter-process-communication-ipc/#:~:text=Inter%2Dprocess%20communication%20(IPC),of%20co%2Doperation%20between%20them."}],"platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[{"key":"enterprise/T1559.001","id":"T1559.001","name":"Component Object Model","page":"techniques/enterprise/T1559.001/"},{"key":"enterprise/T1559.002","id":"T1559.002","name":"Dynamic Data Exchange","page":"techniques/enterprise/T1559.002/"},{"key":"enterprise/T1559.003","id":"T1559.003","name":"XPC Services","page":"techniques/enterprise/T1559.003/"}],"telemetry":[{"id":"DC0055","name":"File Access","page":"telemetry/DC0055/","kind":"attack_component","category":"Windows and directory audit","description":"Access to file objects with user, process and access-right context.","collection_focus":"Enable Audit File System plus a narrow SACL on a lab directory; on Linux select path/syscall rules and join associated Audit records.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["path","access","actor","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0055","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","access":"read","actor":"LAB\\analyst","result":"success"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."},{"id":"DC0048","name":"Named Pipe Metadata","page":"telemetry/DC0048/","kind":"attack_component","category":"Endpoint activity","description":"Metadata about a named pipe and its creation or connection.","collection_focus":"Collect Sysmon PipeEvent 17–18 with pipe name and owning/connecting process; pipe contents require other instrumentation.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","Keep this Windows-specific source separate from other operating systems; there is no direct cross-platform event-ID equivalence."],"configuration_example":null,"required_fields":["pipe_name","action","process_id"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0048","collector":"illustrative-lab-collector","observation":{"pipe_name":"\\\\.\\pipe\\lab-demo","action":"connect","process_id":4200}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0035","name":"Process Access","page":"telemetry/DC0035/","kind":"attack_component","category":"Endpoint activity","description":"One process opening or accessing another process.","collection_focus":"Scope Sysmon ProcessAccess (10) to the selected source/target processes and access rights; retain call-trace fields where emitted.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["source_process_id","target_process_id","granted_access","action"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0035","collector":"illustrative-lab-collector","observation":{"source_process_id":4200,"target_process_id":4300,"granted_access":"0x1000","action":"open_process"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0029","name":"Script Execution","page":"telemetry/DC0029/","kind":"attack_component","category":"Script and command execution","description":"Script content or script execution observations from an interpreter-aware sensor.","collection_focus":"Collect PowerShell 4104 with script-block ID and fragment sequence; instrument other engines separately rather than assigning them the same event ID.","providers":[{"name":"PowerShell Script Block Logging","scope":"Script content via event 4104 when configured; channel depends on PowerShell edition.","source_id":"powershell"},{"name":"Sysmon process events","scope":"Interpreter launch and parent context, not full script content.","source_id":"sysmon"},{"name":"Linux Audit","scope":"execve-family execution context; shell built-ins need additional instrumentation.","source_id":"linux"}],"configuration":["Enable Script Block Logging through the policy/configuration for the installed edition. Forward Microsoft-Windows-PowerShell/Operational for Windows PowerShell, or PowerShellCore/Operational for PowerShell 7.","Retain script-block ID and fragment ordering alongside process creation. Protect access to collected script text; secrets may be included.","On Linux, use narrowly scoped Audit execution rules for the lab account and supported architectures, and retain joined SYSCALL/EXECVE/PATH records."],"configuration_example":{"label":"Read recent Windows PowerShell script-block events","language":"powershell","source_id":"powershell","content":"Get-WinEvent -FilterHashtable @{\n  LogName = 'Microsoft-Windows-PowerShell/Operational'\n  Id = 4104\n} -MaxEvents 5","note":"Read-only check after Script Block Logging is configured. For PowerShell 7 use its registered PowerShellCore/Operational channel. Missing events are not proof of no execution; check policy, channel and permissions."},"required_fields":["engine","script_block_id","fragment","fragments_total","script_text"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0029","collector":"illustrative-lab-collector","observation":{"engine":"PowerShell","script_block_id":"lab-script-1","fragment":1,"fragments_total":1,"script_text":"Write-Output \"LAB_TELEMETRY_CHECK\""}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Script content and process command lines are different signals. Logging may be partial, fragmented, filtered or disabled; never assume a command line reveals everything executed.","sources":[{"id":"powershell","title":"Microsoft PowerShell logging on Windows","url":"https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows?view=powershell-7.5"},{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Per host role and principal: rare interpreters, command argument patterns and parent-child sequences. Normalize scripts carefully; obfuscation, administrative automation and missing command lines change visibility."}],"detection":{"key":"enterprise/T1559","id":"T1559","name":"Inter-Process Communication","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"source_url":"https://attack.mitre.org/techniques/T1559","technique_page":"techniques/enterprise/T1559/","page":"detections/enterprise/T1559/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"sigma_rules":[],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0493","name":"Detect Abuse of Inter-Process Communication (T1559)","url":"https://attack.mitre.org/detectionstrategies/DET0493","stix_id":"x-mitre-detection-strategy--b38e114c-f00f-4c70-9623-267da801625a","relationship_id":"relationship--1b2aecdf-2085-4488-9519-dabeb9402622","description":"","analytics":[{"id":"AN1357","name":"Analytic 1357","guidance":"Detects anomalous use of COM, DDE, or named pipes for execution. Correlates creation or access of IPC mechanisms (e.g., named pipes, COM objects) with unusual parent-child process relationships or code injection patterns (e.g., Office spawning cmd.exe via DDE).","url":"https://attack.mitre.org/detectionstrategies/DET0493#AN1357","platforms":["Windows"],"tuning":[{"field":"PipeNamePattern","description":"Environment-specific pipe names used legitimately vs anomalous (e.g., \\\\.\\pipe\\svcctl)."},{"field":"AllowedParentChildPairs","description":"Expected parent-child process lineage to minimize false positives (e.g., explorer.exe spawning outlook.exe)."}],"log_sources":[{"component_id":"DC0035","component":"Process Access","name":"WinEventLog:Security","channel":"EventCode=4663, 4670, 4656","platforms":["Windows"],"analytic_id":"AN1357","source_url":"https://attack.mitre.org/detectionstrategies/DET0493#AN1357","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0035/"},{"component_id":"DC0048","component":"Named Pipe Metadata","name":"WinEventLog:Sysmon","channel":"EventCode=17","platforms":["Windows"],"analytic_id":"AN1357","source_url":"https://attack.mitre.org/detectionstrategies/DET0493#AN1357","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0048/"}]},{"id":"AN1358","name":"Analytic 1358","guidance":"Detects abuse of UNIX domain sockets, pipes, or message queues for unauthorized code execution. Correlates unexpected socket creation with suspicious binaries, abnormal shell pipelines, or injected processes establishing IPC channels.","url":"https://attack.mitre.org/detectionstrategies/DET0493#AN1358","platforms":["Linux"],"tuning":[{"field":"SocketPathBaseline","description":"Expected UNIX socket paths used by system services and applications."},{"field":"FIFOAccessPatterns","description":"Legitimate processes expected to open pipes in shared directories."}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"auditd:SYSCALL","channel":"socket: Suspicious creation of AF_UNIX sockets outside expected daemons","platforms":["Linux"],"analytic_id":"AN1358","source_url":"https://attack.mitre.org/detectionstrategies/DET0493#AN1358","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0055","component":"File Access","name":"auditd:SYSCALL","channel":"open: Access to named pipes or FIFO in /tmp or /dev/shm by unexpected processes","platforms":["Linux"],"analytic_id":"AN1358","source_url":"https://attack.mitre.org/detectionstrategies/DET0493#AN1358","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0055/"}]},{"id":"AN1359","name":"Analytic 1359","guidance":"Detects anomalous use of Mach ports, Apple Events, or XPC services for inter-process execution or code injection. Focuses on unexpected processes attempting to send privileged Apple Events (e.g., automation scripts injecting into security-sensitive apps).","url":"https://attack.mitre.org/detectionstrategies/DET0493#AN1359","platforms":["macOS"],"tuning":[{"field":"AllowedAppleEventTargets","description":"Whitelisted app-to-app Apple Event communications (e.g., Finder automation)."},{"field":"MachPortBaseline","description":"Baseline of Mach ports and XPC services normally used in the environment."}],"log_sources":[{"component_id":"DC0035","component":"Process Access","name":"macos:unifiedlog","channel":"Unusual Mach port registration or access attempts between unrelated processes","platforms":["macOS"],"analytic_id":"AN1359","source_url":"https://attack.mitre.org/detectionstrategies/DET0493#AN1359","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0035/"},{"component_id":"DC0029","component":"Script Execution","name":"macos:osquery","channel":"exec: Unexpected execution of osascript or AppleScript targeting sensitive apps","platforms":["macOS"],"analytic_id":"AN1359","source_url":"https://attack.mitre.org/detectionstrategies/DET0493#AN1359","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0029/"}]}]}],"telemetry_references":[{"id":"DC0055","name":"File Access","tag":"File Access","page":"telemetry/DC0055/","kind":"attack_component"},{"id":"DC0048","name":"Named Pipe Metadata","tag":"Named Pipe Metadata","page":"telemetry/DC0048/","kind":"attack_component"},{"id":"DC0035","name":"Process Access","tag":"Process Access","page":"telemetry/DC0035/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"},{"id":"DC0029","name":"Script Execution","tag":"Script Execution","page":"telemetry/DC0029/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[{"id":"S0022","name":"Uroburos","url":"https://attack.mitre.org/software/S0022","kind":"malware","description":"[Uroburos](https://attack.mitre.org/software/S0022) has the ability to move data between its kernel and user mode components, generally using named pipes.(Citation: Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023)","relationship_id":"relationship--70efcdd6-80c3-4f95-981b-4da24639f32b","references":[{"source_name":"Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023","description":"FBI et al. (2023, May 9). Hunting Russian Intelligence “Snake” Malware. Retrieved June 8, 2023.","url":"https://www.cisa.gov/sites/default/files/2023-05/aa23-129a_snake_malware_2.pdf"}]},{"id":"S0537","name":"HyperStack","url":"https://attack.mitre.org/software/S0537","kind":"malware","description":"[HyperStack](https://attack.mitre.org/software/S0537) can connect to the IPC$ share on remote machines.(Citation: Accenture HyperStack October 2020)","relationship_id":"relationship--82fa754d-3c73-415f-9bc3-3e6be5458856","references":[{"source_name":"Accenture HyperStack October 2020","description":"Accenture. (2020, October). Turla uses HyperStack, Carbon, and Kazuar to compromise government entity. Retrieved December 2, 2020.","url":"https://web.archive.org/web/20201101015247/https://www.accenture.com/us-en/blogs/cyber-defense/turla-belugasturgeon-compromises-government-entity"}]},{"id":"S0687","name":"Cyclops Blink","url":"https://attack.mitre.org/software/S0687","kind":"malware","description":"[Cyclops Blink](https://attack.mitre.org/software/S0687) has the ability to create a pipe to enable inter-process communication.(Citation: Trend Micro Cyclops Blink March 2022)","relationship_id":"relationship--aba4b49c-0e87-4e81-81ce-cdefff278c5f","references":[{"source_name":"Trend Micro Cyclops Blink March 2022","description":"Haquebord, F. et al. (2022, March 17). Cyclops Blink Sets Sights on Asus Routers. Retrieved March 17, 2022.","url":"https://www.trendmicro.com/en_us/research/22/c/cyclops-blink-sets-sights-on-asus-routers--.html"}]},{"id":"S1078","name":"RotaJakiro","url":"https://attack.mitre.org/software/S1078","kind":"malware","description":"When executing with non-root permissions, [RotaJakiro](https://attack.mitre.org/software/S1078) uses the the `shmget API` to create shared memory between other known [RotaJakiro](https://attack.mitre.org/software/S1078) processes. This allows processes to communicate with each other and share their PID.(Citation: RotaJakiro 2021 netlab360 analysis)","relationship_id":"relationship--d5b2d34f-5650-4fb3-bacf-2b1765943bfe","references":[{"source_name":"RotaJakiro 2021 netlab360 analysis","description":" Alex Turing, Hui Wang. (2021, April 28). RotaJakiro: A long live secret backdoor with 0 VT detection. Retrieved June 14, 2023.","url":"https://blog.netlab.360.com/stealth_rotajakiro_backdoor_en/"}]},{"id":"S1100","name":"Ninja","url":"https://attack.mitre.org/software/S1100","kind":"malware","description":"[Ninja](https://attack.mitre.org/software/S1100) can use pipes to redirect the standard input and the standard output.(Citation: Kaspersky ToddyCat June 2022)","relationship_id":"relationship--e4d5f735-1629-48f8-9728-f76adf586a0b","references":[{"source_name":"Kaspersky ToddyCat June 2022","description":"Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.","url":"https://securelist.com/toddycat/106799/"}]},{"id":"S1123","name":"PITSTOP","url":"https://attack.mitre.org/software/S1123","kind":"malware","description":"[PITSTOP](https://attack.mitre.org/software/S1123) can listen over the Unix domain socket located at `/data/runtime/cockpit/wd.fd`.(Citation: Mandiant Cutting Edge Part 3 February 2024)","relationship_id":"relationship--5a094c68-b8cd-470b-a4ff-11109fd0b309","references":[{"source_name":"Mandiant Cutting Edge Part 3 February 2024","description":"Lin, M. et al. (2024, February 27). Cutting Edge, Part 3: Investigating Ivanti Connect Secure VPN Exploitation and Persistence Attempts. Retrieved March 1, 2024.","url":"https://www.mandiant.com/resources/blog/investigating-ivanti-exploitation-persistence"}]},{"id":"S1130","name":"Raspberry Robin","url":"https://attack.mitre.org/software/S1130","kind":"malware","description":"[Raspberry Robin](https://attack.mitre.org/software/S1130) contains an embedded custom [Tor](https://attack.mitre.org/software/S0183) network client that communicates with the primary payload via shared process memory.(Citation: TrendMicro RaspberryRobin 2022)","relationship_id":"relationship--2f1cb78e-3859-4e7f-976e-ddb791ffdad3","references":[{"source_name":"TrendMicro RaspberryRobin 2022","description":"Christopher So. (2022, December 20). Raspberry Robin Malware Targets Telecom, Governments. Retrieved May 17, 2024.","url":"https://www.trendmicro.com/en_us/research/22/l/raspberry-robin-malware-targets-telecom-governments.html"}]},{"id":"S1141","name":"LunarWeb","url":"https://attack.mitre.org/software/S1141","kind":"malware","description":"[LunarWeb](https://attack.mitre.org/software/S1141) can retrieve output from arbitrary processes and shell commands via a pipe.(Citation: ESET Turla Lunar toolset May 2024)","relationship_id":"relationship--dc815cae-8024-469b-b801-5d187ffeca81","references":[{"source_name":"ESET Turla Lunar toolset May 2024","description":"Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.","url":"https://www.welivesecurity.com/en/eset-research/moon-backdoors-lunar-landing-diplomatic-missions/"}]},{"id":"S1150","name":"ROADSWEEP","url":"https://attack.mitre.org/software/S1150","kind":"malware","description":"[ROADSWEEP](https://attack.mitre.org/software/S1150) can pipe command output to a targeted process.(Citation: Mandiant ROADSWEEP August 2022)","relationship_id":"relationship--54607e53-5952-47f1-bffa-72379bbf58c8","references":[{"source_name":"Mandiant ROADSWEEP August 2022","description":"Jenkins, L. at al. (2022, August 4). ROADSWEEP Ransomware - Likely Iranian Threat Actor Conducts Politically Motivated Disruptive Activity Against Albanian Government Organizations. Retrieved August 6, 2024.","url":"https://cloud.google.com/blog/topics/threat-intelligence/likely-iranian-threat-actor-conducts-politically-motivated-disruptive-activity-against/"}]},{"id":"S1172","name":"OilBooster","url":"https://attack.mitre.org/software/S1172","kind":"malware","description":"[OilBooster](https://attack.mitre.org/software/S1172) can read the results of command line execution via an unnamed pipe connected to the process.(Citation: ESET OilRig Downloaders DEC 2023)","relationship_id":"relationship--8f2f514a-81be-4f14-be6f-d442814b9bd6","references":[{"source_name":"ESET OilRig Downloaders DEC 2023","description":"Hromcova, Z. and Burgher, A. (2023, December 14). OilRig’s persistent attacks using cloud service-powered downloaders. Retrieved November 26, 2024.","url":"https://www.welivesecurity.com/en/eset-research/oilrig-persistent-attacks-cloud-service-powered-downloaders/"}]},{"id":"S1200","name":"StealBit","url":"https://attack.mitre.org/software/S1200","kind":"malware","description":"[StealBit](https://attack.mitre.org/software/S1200) can use interprocess communication (IPC) to enable the designation of multiple files for exfiltration in a scalable manner.(Citation: Cybereason StealBit Exfiltration Tool)\n","relationship_id":"relationship--27e71f08-221a-47cf-a583-b32c2db001ee","references":[{"source_name":"Cybereason StealBit Exfiltration Tool","description":"Cybereason Global SOC Team. (n.d.). THREAT ANALYSIS REPORT: Inside the LockBit Arsenal - The StealBit Exfiltration Tool. Retrieved January 29, 2025.","url":"https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool"}]},{"id":"S1229","name":"Havoc","url":"https://attack.mitre.org/software/S1229","kind":"malware","description":"The [Havoc](https://attack.mitre.org/software/S1229) SMB demon can use named pipes for communication through a parent demon.(Citation: Havoc Framework Documentation)","relationship_id":"relationship--22f3b02d-e475-4d42-b4ae-b63da598e060","references":[{"source_name":"Havoc Framework Documentation","description":"Ungur, P. (n.d.). HAVOC. Retrieved August 4, 2025.","url":"https://havocframework.com/docs/welcome"}]},{"id":"S1239","name":"TONESHELL","url":"https://attack.mitre.org/software/S1239","kind":"malware","description":"[TONESHELL](https://attack.mitre.org/software/S1239) has facilitated inter-process communication between DLL components via the use of pipes.(Citation: Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023) [TONESHELL](https://attack.mitre.org/software/S1239) has also created a reverse shell using two anonymous pipes to write data to stdin and read data from stdout and stderr.(Citation: 2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA)","relationship_id":"relationship--ec6b9512-b23a-4aac-87b8-b5c4c19493de","references":[{"source_name":"2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA","description":"Golo Muhr, Joshua Chung. (2025, May 15). Hive0154 targeting US, Philippines, Pakistan and Taiwan in suspected espionage campaign. Retrieved August 4, 2025.","url":"https://www.ibm.com/think/x-force/hive0154-targeting-us-philippines-pakistan-taiwan"},{"source_name":"Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023","description":"Lior Rochberger, Tom Fakterman, Robert Falcone. (2023, September 22). Cyberespionage Attacks Against Southeast Asian Government Linked to Stately Taurus, Aka Mustang Panda. Retrieved September 9, 2025.","url":"https://unit42.paloaltonetworks.com/stately-taurus-attacks-se-asian-government/"}]},{"id":"S1244","name":"Medusa Ransomware","url":"https://attack.mitre.org/software/S1244","kind":"malware","description":"[Medusa Ransomware](https://attack.mitre.org/software/S1244) has leveraged the `CreatePipe` API to enable inter-process communication.(Citation: Security Scorecard Medusa Ransomware January 2024)","relationship_id":"relationship--9d753094-3f5a-4d38-88dd-13289e1d8318","references":[{"source_name":"Security Scorecard Medusa Ransomware January 2024","description":"Vlad Pasca. (2024, January 1). A Deep Dive into Medusa Ransomware. Retrieved October 15, 2025.","url":"https://securityscorecard.com/wp-content/uploads/2024/01/deep-dive-into-medusa-ransomware.pdf"}]},{"id":"S9024","name":"SPAWNCHIMERA","url":"https://attack.mitre.org/software/S9024","kind":"malware","description":"[SPAWNCHIMERA](https://attack.mitre.org/software/S9024) has leveraged IPC using a UNIX domain socket between the dsmdm process and the web process.(Citation: Google UNC5221 BRICKSTORM SPAWNCHIMERA April 2024)(Citation: JPCERT SPAWNCHIMERA Ivanti February 2025)","relationship_id":"relationship--a65e797a-d529-427b-82aa-33edf4ead0a2","references":[{"source_name":"Google UNC5221 BRICKSTORM SPAWNCHIMERA April 2024","description":"Matt Lin, Austin Larsen, John Wolfram, Ashley Pearson, Josh Murchie, Lukasz Lamparski, Joseph Pisano, Ryan Hall, Ron Craft, Shawn Crew, Billy Wong, Tyler McLellan. (2024, April 4). Cutting Edge, Part 4: Ivanti Connect Secure VPN Post-Exploitation Lateral Movement Case Studies. Retrieved April 16, 2026.","url":"https://cloud.google.com/blog/topics/threat-intelligence/ivanti-post-exploitation-lateral-movement"},{"source_name":"JPCERT SPAWNCHIMERA Ivanti February 2025","description":"Yuma Masubuchi. (2025, February 20). SPAWNCHIMERA Malware: The Chimera Spawning from Ivanti Connect Secure Vulnerability. Retrieved April 17, 2026.","url":"https://blogs.jpcert.or.jp/en/2025/02/spawnchimera.html"}]},{"id":"S9043","name":"Mini Shai-Hulud","url":"https://attack.mitre.org/software/S9043","kind":"malware","description":"[Mini Shai-Hulud](https://attack.mitre.org/software/S9043) has executed via the use of `subprocess.run` and fed input through standard input `stdin` which acted as a pipe to send data from the parent process and the child process `sys.executable` within memory.(Citation: Trend Micro TeamPCP MAY 2026)(Citation: Hunt.io TeamPCP Toolkit MAY 2026)","relationship_id":"relationship--d3e1a3fd-c00a-47b5-9a51-29546f6519e3","references":[{"source_name":"Hunt.io TeamPCP Toolkit MAY 2026","description":"Hunt.io. (2026, May 14). How TeamPCP's Python Toolkit Survives a C2 Takedown: FIRESCALE, GitHub, and the Victim's Own Account. Retrieved July 16, 2026.","url":"https://hunt.io/blog/teampcp-python-toolkit-firescale-github-c2-takedown"},{"source_name":"Trend Micro TeamPCP MAY 2026","description":"Santos, J. and Navato, J.R. (2026, May 13). Analyzing TeamPCP’s Supply Chain Attacks: Checkmarx KICS and elementary-data in CI/CD Credential Theft. Retrieved July 16, 2026.","url":"https://www.trendmicro.com/en_us/research/26/e/analyzing-teampcp-supply-chain-attacks.html"}]},{"id":"S9062","name":"MiniBrowse","url":"https://attack.mitre.org/software/S9062","kind":"malware","description":"[MiniBrowse](https://attack.mitre.org/software/S9062) has sent JSON files to a named pipe.(Citation: CheckPoint_NimbusManticoreEurope_Sept2025)","relationship_id":"relationship--32ebbca7-d489-4810-a129-6019dccf42a0","references":[{"source_name":"CheckPoint_NimbusManticoreEurope_Sept2025","description":"Check Point. (2025, September 22). Nimbus Manticore Deploys New Malware Targeting Europe. Retrieved September 24, 2026.","url":"https://research.checkpoint.com/2025/nimbus-manticore-deploys-new-malware-targeting-europe/"}]}],"actors":[],"mitigations":[{"id":"M1013","name":"Application Developer Guidance","url":"https://attack.mitre.org/mitigations/M1013","kind":"course-of-action","description":"Enable the Hardened Runtime capability when developing applications. Do not include the <code>com.apple.security.get-task-allow</code> entitlement with the value set to any variation of true. ","relationship_id":"relationship--f60e5a0d-cfdf-4c4e-be35-af5a2bdbc131","references":[]},{"id":"M1026","name":"Privileged Account Management","url":"https://attack.mitre.org/mitigations/M1026","kind":"course-of-action","description":"Modify Registry settings (directly or using Dcomcnfg.exe) in `HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Classes\\\\AppID\\\\{AppID_GUID}` associated with the process-wide security of individual COM applications.(Citation: Microsoft Process Wide Com Keys)\n\nModify Registry settings (directly or using Dcomcnfg.exe) in `HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Microsoft\\\\Ole` associated with system-wide security defaults for all COM applications that do no set their own process-wide security.(Citation: Microsoft System Wide Com Keys) (Citation: Microsoft COM ACL)","relationship_id":"relationship--c111033c-3544-43b8-9168-32590659557d","references":[{"source_name":"Microsoft Process Wide Com Keys","description":"Microsoft. (n.d.). Setting Process-Wide Security Through the Registry. Retrieved November 21, 2017.","url":"https://msdn.microsoft.com/en-us/library/windows/desktop/ms687317(v=vs.85).aspx"},{"source_name":"Microsoft System Wide Com Keys","description":"Microsoft. (n.d.). Registry Values for System-Wide Security. Retrieved November 21, 2017.","url":"https://msdn.microsoft.com/en-us/library/windows/desktop/ms694331(v=vs.85).aspx"},{"source_name":"Microsoft COM ACL","description":"Microsoft. (n.d.). DCOM Security Enhancements in Windows XP Service Pack 2 and Windows Server 2003 Service Pack 1. Retrieved November 22, 2017.","url":"https://docs.microsoft.com/en-us/windows/desktop/com/dcom-security-enhancements-in-windows-xp-service-pack-2-and-windows-server-2003-service-pack-1"}]},{"id":"M1040","name":"Behavior Prevention on Endpoint","url":"https://attack.mitre.org/mitigations/M1040","kind":"course-of-action","description":"On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent DDE attacks and spawning of child processes from Office programs.(Citation: Microsoft ASR Nov 2017)(Citation: Enigma Reviving DDE Jan 2018)","relationship_id":"relationship--ca928ba4-bb4b-4cd9-a105-8c0d4d81891f","references":[{"source_name":"Microsoft ASR Nov 2017","description":"Brower, N. & D'Souza-Wiltshire, I. (2017, November 9). Enable Attack surface reduction. Retrieved February 3, 2018.","url":"https://docs.microsoft.com/windows/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction"},{"source_name":"Enigma Reviving DDE Jan 2018","description":"Nelson, M. (2018, January 29). Reviving DDE: Using OneNote and Excel for Code Execution. Retrieved February 3, 2018.","url":"https://posts.specterops.io/reviving-dde-using-onenote-and-excel-for-code-execution-d7226864caee"}]},{"id":"M1042","name":"Disable or Remove Feature or Program","url":"https://attack.mitre.org/mitigations/M1042","kind":"course-of-action","description":"Registry keys specific to Microsoft Office feature control security can be set to disable automatic DDE/OLE execution. (Citation: Microsoft DDE Advisory Nov 2017)(Citation: BleepingComputer DDE Disabled in Word Dec 2017)(Citation: GitHub Disable DDEAUTO Oct 2017) Microsoft also created, and enabled by default, Registry keys to completely disable DDE execution in Word and Excel.(Citation: Microsoft ADV170021 Dec 2017)","relationship_id":"relationship--16f46969-91e3-4bcd-8d58-97e88e6b1d3e","references":[{"source_name":"Microsoft DDE Advisory Nov 2017","description":"Microsoft. (2017, November 8). Microsoft Security Advisory 4053440 - Securely opening Microsoft Office documents that contain Dynamic Data Exchange (DDE) fields. Retrieved November 21, 2017.","url":"https://technet.microsoft.com/library/security/4053440"},{"source_name":"BleepingComputer DDE Disabled in Word Dec 2017","description":"Cimpanu, C. (2017, December 15). Microsoft Disables DDE Feature in Word to Prevent Further Malware Attacks. Retrieved December 19, 2017.","url":"https://www.bleepingcomputer.com/news/microsoft/microsoft-disables-dde-feature-in-word-to-prevent-further-malware-attacks/"},{"source_name":"GitHub Disable DDEAUTO Oct 2017","description":"Dormann, W. (2017, October 20). Disable DDEAUTO for Outlook, Word, OneNote, and Excel versions 2010, 2013, 2016. Retrieved February 3, 2018.","url":"https://gist.github.com/wdormann/732bb88d9b5dd5a66c9f1e1498f31a1b"},{"source_name":"Microsoft ADV170021 Dec 2017","description":"Microsoft. (2017, December 12). ADV170021 - Microsoft Office Defense in Depth Update. Retrieved February 3, 2018.","url":"https://portal.msrc.microsoft.com/security-guidance/advisory/ADV170021"}]},{"id":"M1048","name":"Application Isolation and Sandboxing","url":"https://attack.mitre.org/mitigations/M1048","kind":"course-of-action","description":"Ensure all COM alerts and Protected View are enabled.(Citation: Microsoft Protected View)","relationship_id":"relationship--73c6ad27-074a-437d-82ec-39592b783160","references":[{"source_name":"Microsoft Protected View","description":"Microsoft. (n.d.). What is Protected View?. Retrieved November 22, 2017.","url":"https://support.office.com/en-us/article/What-is-Protected-View-d6f09ac7-e6b9-4495-8e43-2bbcdbcb6653"}]},{"id":"M1054","name":"Software Configuration","url":"https://attack.mitre.org/mitigations/M1054","kind":"course-of-action","description":"Consider disabling embedded files in Office programs, such as OneNote, that do not work with Protected View.(Citation: Enigma Reviving DDE Jan 2018)(Citation: GitHub Disable DDEAUTO Oct 2017)","relationship_id":"relationship--39a3fc74-012e-47fc-b806-d9267a0f54ba","references":[{"source_name":"Enigma Reviving DDE Jan 2018","description":"Nelson, M. (2018, January 29). Reviving DDE: Using OneNote and Excel for Code Execution. Retrieved February 3, 2018.","url":"https://posts.specterops.io/reviving-dde-using-onenote-and-excel-for-code-execution-d7226864caee"},{"source_name":"GitHub Disable DDEAUTO Oct 2017","description":"Dormann, W. (2017, October 20). Disable DDEAUTO for Outlook, Word, OneNote, and Excel versions 2010, 2013, 2016. Retrieved February 3, 2018.","url":"https://gist.github.com/wdormann/732bb88d9b5dd5a66c9f1e1498f31a1b"}]}],"candidates":[{"id":"17521690-2183-460f-a182-5dfd6f9f0a7f","name":"Create Named Pipe","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1559/T1559.yaml","description":"Creates a named pipe using PowerShell. Named pipes are a common inter-process communication mechanism\nthat adversaries use to facilitate data exchange between processes or as a command-and-control channel.\n","inputs":{"pipe_name":{"description":"Name of the named pipe to create (without the \\\\.\\pipe\\ prefix)","type":"string","default":"atomic_pipe"}},"dependencies":[],"source_definition_sha256":"a6f96eb74b5e608137bed3e9bb0344fa3b3963e2883672fd7574370fca0c8fa9"},{"id":"7a48f482-246f-4aeb-9837-21c271ebf244","name":"Cobalt Strike post-exploitation pipe (4.2 and later)","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1559/T1559.yaml","description":"Uses the [Named Pipes Micro Emulation](https://github.com/center-for-threat-informed-defense/adversary_emulation_library/tree/master/micro_emulation_plans/src/named_pipes) executable from the Center for Threat Informed Defense to create a named pipe for inter-process communication.\n\nThe named pipe executable will pause for 30 seconds to allow the client and server to exchange a message through the pipe.\n","inputs":{},"dependencies":[{"description":"Named pipe executors must exist on disk\n"}],"source_definition_sha256":"ad95b8b7133c8b130bdb67403cd5e025c7d81df6882fa27f0b335c5b747c7cce"},{"id":"7a8f8ae9-6b1d-4f7b-88e7-9ea01234eee5","name":"Named Pipe Integrity Reduction for Turla's RPC backdoor","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1559/T1559.yaml","description":"Emulates the server-side behavior of Turla's RPC backdoors. First checks to see if the named pipe atctl is in the\nregistry key for NullSessionPipes, and if so, modifies the security descriptor of the pipe to allow untrusted/anonymous\nintegrity level callers via SetSecurityInfo. Essentially allows unauthenticated users to have privileged RCE on the server machine through RPC.\n\nReference: https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/\n","inputs":{"pipe_name":{"description":"Name of the named pipe to create","type":"string","default":"atctl"}},"dependencies":[{"description":"NullSessionPipes must contain the pipe name for the security descriptor to be set"}],"source_definition_sha256":"049ab752f85312a141917557fb851c5831882690e31de5d2a17cb6578120c3f0"},{"id":"830c8b6c-7a70-4f40-b975-8bbe74558acd","name":"Cobalt Strike Lateral Movement (psexec_psh) pipe","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1559/T1559.yaml","description":"Uses the [Named Pipes Micro Emulation](https://github.com/center-for-threat-informed-defense/adversary_emulation_library/tree/master/micro_emulation_plans/src/named_pipes) executable from the Center for Threat Informed Defense to create a named pipe for inter-process communication.\n\nThe named pipe executable will pause for 30 seconds to allow the client and server to exchange a message through the pipe.\n","inputs":{},"dependencies":[{"description":"Named pipe executors must exist on disk\n"}],"source_definition_sha256":"2cc659ae41cfb1bbef4ccb2cecb62399ef654c5ecdb2919e1c26d4f6b21116f5"},{"id":"8dbfc15c-527b-4ab0-a272-019f469d367f","name":"Cobalt Strike post-exploitation pipe (before 4.2)","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1559/T1559.yaml","description":"Uses the [Named Pipes Micro Emulation](https://github.com/center-for-threat-informed-defense/adversary_emulation_library/tree/master/micro_emulation_plans/src/named_pipes) executable from the Center for Threat Informed Defense to create a named pipe for inter-process communication.\n\nThe named pipe executable will pause for 30 seconds to allow the client and server to exchange a message through the pipe.\n","inputs":{},"dependencies":[{"description":"Named pipe executors must exist on disk\n"}],"source_definition_sha256":"b82ca24891f5df9fe7bd4594fa2d0f1db06625accd4331d9103750d0226b234a"},{"id":"bd13b9fc-b758-496a-b81a-397462f82c72","name":"Cobalt Strike Artifact Kit pipe","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1559/T1559.yaml","description":"Uses the [Named Pipes Micro Emulation](https://github.com/center-for-threat-informed-defense/adversary_emulation_library/tree/master/micro_emulation_plans/src/named_pipes) executable from the Center for Threat Informed Defense to create a named pipe for inter-process communication.\n\nThe named pipe executable will pause for 30 seconds to allow the client and server to exchange a message through the pipe.\n","inputs":{},"dependencies":[{"description":"Named pipe executors must exist on disk\n"}],"source_definition_sha256":"ba3244510b3b742bae3d1a49e3fdeda0b5d5b390874979195eff70dad485855d"},{"id":"d1f72fa0-5bc2-4b4b-bd1e-43b6e8cfb2e6","name":"Cobalt Strike SSH (postex_ssh) pipe","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1559/T1559.yaml","description":"Uses the [Named Pipes Micro Emulation](https://github.com/center-for-threat-informed-defense/adversary_emulation_library/tree/master/micro_emulation_plans/src/named_pipes) executable from the Center for Threat Informed Defense to create a named pipe for inter-process communication.\n\nThe named pipe executable will pause for 30 seconds to allow the client and server to exchange a message through the pipe.\n","inputs":{},"dependencies":[{"description":"Named pipe executors must exist on disk\n"}],"source_definition_sha256":"76064dbc1199b57a943fc3e9b1819efa501f634204a775029f3d37d8a8789b49"}],"simulation":{"atomic_status":"documented_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1559.002":"/ttp-simulation/techniques/enterprise/T1559.002/","T1559.001":"/ttp-simulation/techniques/enterprise/T1559.001/","T1059":"/ttp-simulation/techniques/enterprise/T1059/","T1021":"/ttp-simulation/techniques/enterprise/T1021/","T1021.003":"/ttp-simulation/techniques/enterprise/T1021.003/","T1559":"/ttp-simulation/techniques/enterprise/T1559/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1559","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0055","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","access":"read","actor":"LAB\\analyst","result":"success"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0048","collector":"illustrative-lab-collector","observation":{"pipe_name":"\\\\.\\pipe\\lab-demo","action":"connect","process_id":4200}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0035","collector":"illustrative-lab-collector","observation":{"source_process_id":4200,"target_process_id":4300,"granted_access":"0x1000","action":"open_process"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0029","collector":"illustrative-lab-collector","observation":{"engine":"PowerShell","script_block_id":"lab-script-1","fragment":1,"fragments_total":1,"script_text":"Write-Output \"LAB_TELEMETRY_CHECK\""}}]}}