T1559.002 Dynamic Data Exchange — Attack Simulation

Adversaries may use Windows Dynamic Data Exchange (DDE) to execute arbitrary commands. DDE is a client-server protocol for one-time and/or continuous inter-process communication (IPC) between applications. Once a link is established, applications can autonomously exchange transactions consisting of strings, warm data links (notifications when a data item changes), hot data links (duplications of changes to a data item), and requests for command…

Technique description

At least one platform-compatible Atomic procedure is documented. Individual review, lab prerequisites, and validation remain required.

Official ATT&CK definition · Detection rules and anomaly models

Documented simulation candidates

Execute PowerShell script via Word DDE
windows automated command_prompt
Procedure 47c21fb6-085e-4b0d-b4d2-26d72c3830b3; elevation not declared required; cleanup not declared. Not executed or individually validated.
DDEAUTO
windows manual manual
Procedure cf91174c-4e74-414e-bec0-8d60a104d181; elevation not declared required; cleanup not declared. Not executed or individually validated.
Execute Commands
windows manual manual
Procedure f592ba2a-e9e8-4d62-a459-ef63abd819fd; elevation not declared required; cleanup not declared. Not executed or individually validated.

Connected ecosystem references

Linked tags

enterprise cloud-hosted-endpoint onprem Windows execution isolated_authorized_lab procedure_review_required telemetry_configuration_required

can_simulate subtechnique source_mapped

Detection and collection

T1559.002 detection workspace

Attack tools

No reviewed association in this snapshot.

Threat actor context

These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.

Existing research

Threat Matrix: knowledge routes, evidence and actor context

Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.