T1559 Inter-Process Communication — Attack Simulation

DC0055 collection page — Enable Audit File System plus a narrow SACL on a lab directory; on Linux select path/syscall rules and join associated Audit records.

Providers and collection configuration

• Windows Security auditing: Policy-dependent account, object, task and logon records on the host that performs the operation.

• Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.
• For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.
• Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*.

Required normalized fields: path, access, actor, result.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0055",
  "collector": "illustrative-lab-collector",
  "observation": {
    "path": "C:\\Lab\\demo.txt",
    "access": "read",
    "actor": "LAB\\analyst",
    "result": "success"
  }
}

Visibility limits: A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.

DC0048 collection page — Collect Sysmon PipeEvent 17–18 with pipe name and owning/connecting process; pipe contents require other instrumentation.

Providers and collection configuration

• Microsoft Sysmon: Windows event-based collection; enable the event types needed below.

• On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.
• Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.
• Keep this Windows-specific source separate from other operating systems; there is no direct cross-platform event-ID equivalence.

Required normalized fields: pipe_name, action, process_id.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0048",
  "collector": "illustrative-lab-collector",
  "observation": {
    "pipe_name": "\\\\.\\pipe\\lab-demo",
    "action": "connect",
    "process_id": 4200
  }
}

Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.

DC0035 collection page — Scope Sysmon ProcessAccess (10) to the selected source/target processes and access rights; retain call-trace fields where emitted.

Providers and collection configuration

• Microsoft Sysmon: Windows event-based collection; enable the event types needed below.
• Linux Audit: Linux alternative for supported system-call and file events; different semantics and fields.
• Apple Endpoint Security clients: macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.

• On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.
• Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.
• For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms.

Required normalized fields: source_process_id, target_process_id, granted_access, action.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0035",
  "collector": "illustrative-lab-collector",
  "observation": {
    "source_process_id": 4200,
    "target_process_id": 4300,
    "granted_access": "0x1000",
    "action": "open_process"
  }
}

Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.

DC0032 collection page — Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.

Providers and collection configuration

• Microsoft Sysmon: Windows event-based collection; enable the event types needed below.
• Linux Audit: Linux alternative for supported system-call and file events; different semantics and fields.
• Apple Endpoint Security clients: macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.

• On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.
• Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.
• For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms.

Required normalized fields: process_guid, image, parent_image, command_line, user.

<EventFiltering>
  <ProcessCreate onmatch="include">
    <Image condition="is">C:\Windows\System32\whoami.exe</Image>
  </ProcessCreate>
</EventFiltering>

This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0032",
  "collector": "illustrative-lab-collector",
  "observation": {
    "process_guid": "lab-process-001",
    "image": "C:\\Windows\\System32\\whoami.exe",
    "parent_image": "C:\\Windows\\System32\\cmd.exe",
    "command_line": "whoami",
    "user": "LAB\\analyst"
  }
}

Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.

DC0029 collection page — Collect PowerShell 4104 with script-block ID and fragment sequence; instrument other engines separately rather than assigning them the same event ID.

Providers and collection configuration

• PowerShell Script Block Logging: Script content via event 4104 when configured; channel depends on PowerShell edition.
• Sysmon process events: Interpreter launch and parent context, not full script content.
• Linux Audit: execve-family execution context; shell built-ins need additional instrumentation.

• Enable Script Block Logging through the policy/configuration for the installed edition. Forward Microsoft-Windows-PowerShell/Operational for Windows PowerShell, or PowerShellCore/Operational for PowerShell 7.
• Retain script-block ID and fragment ordering alongside process creation. Protect access to collected script text; secrets may be included.
• On Linux, use narrowly scoped Audit execution rules for the lab account and supported architectures, and retain joined SYSCALL/EXECVE/PATH records.

Required normalized fields: engine, script_block_id, fragment, fragments_total, script_text.

Get-WinEvent -FilterHashtable @{
  LogName = 'Microsoft-Windows-PowerShell/Operational'
  Id = 4104
} -MaxEvents 5

Read-only check after Script Block Logging is configured. For PowerShell 7 use its registered PowerShellCore/Operational channel. Missing events are not proof of no execution; check policy, channel and permissions.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0029",
  "collector": "illustrative-lab-collector",
  "observation": {
    "engine": "PowerShell",
    "script_block_id": "lab-script-1",
    "fragment": 1,
    "fragments_total": 1,
    "script_text": "Write-Output \"LAB_TELEMETRY_CHECK\""
  }
}

Visibility limits: Script content and process command lines are different signals. Logging may be partial, fragmented, filtered or disabled; never assume a command line reveals everything executed.

MITRE detection strategy

No exact-tagged Sigma source rule was imported. This does not establish that the technique is undetectable; the MITRE guidance and collection requirements remain relevant.

• S0022 Uroburos — malware.

  Uroburos has the ability to move data between its kernel and user mode components, generally using named pipes.[Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023]

  Exact relationship: relationship--70efcdd6-80c3-4f95-981b-4da24639f32b
• S0537 HyperStack — malware.

  HyperStack can connect to the IPC$ share on remote machines.[Accenture HyperStack October 2020]

  Exact relationship: relationship--82fa754d-3c73-415f-9bc3-3e6be5458856
• S0687 Cyclops Blink — malware.

  Cyclops Blink has the ability to create a pipe to enable inter-process communication.[Trend Micro Cyclops Blink March 2022]

  Exact relationship: relationship--aba4b49c-0e87-4e81-81ce-cdefff278c5f
• S1078 RotaJakiro — malware.

  When executing with non-root permissions, RotaJakiro uses the the `shmget API` to create shared memory between other known RotaJakiro processes. This allows processes to communicate with each other and share their PID.[RotaJakiro 2021 netlab360 analysis]

  Exact relationship: relationship--d5b2d34f-5650-4fb3-bacf-2b1765943bfe
• S1100 Ninja — malware.

  Ninja can use pipes to redirect the standard input and the standard output.[Kaspersky ToddyCat June 2022]

  Exact relationship: relationship--e4d5f735-1629-48f8-9728-f76adf586a0b
• S1123 PITSTOP — malware.

  PITSTOP can listen over the Unix domain socket located at `/data/runtime/cockpit/wd.fd`.[Mandiant Cutting Edge Part 3 February 2024]

  Exact relationship: relationship--5a094c68-b8cd-470b-a4ff-11109fd0b309
• S1130 Raspberry Robin — malware.

  Raspberry Robin contains an embedded custom Tor network client that communicates with the primary payload via shared process memory.[TrendMicro RaspberryRobin 2022]

  Exact relationship: relationship--2f1cb78e-3859-4e7f-976e-ddb791ffdad3
• S1141 LunarWeb — malware.

  LunarWeb can retrieve output from arbitrary processes and shell commands via a pipe.[ESET Turla Lunar toolset May 2024]

  Exact relationship: relationship--dc815cae-8024-469b-b801-5d187ffeca81
• S1150 ROADSWEEP — malware.

  ROADSWEEP can pipe command output to a targeted process.[Mandiant ROADSWEEP August 2022]

  Exact relationship: relationship--54607e53-5952-47f1-bffa-72379bbf58c8
• S1172 OilBooster — malware.

  OilBooster can read the results of command line execution via an unnamed pipe connected to the process.[ESET OilRig Downloaders DEC 2023]

  Exact relationship: relationship--8f2f514a-81be-4f14-be6f-d442814b9bd6
• S1200 StealBit — malware.

  StealBit can use interprocess communication (IPC) to enable the designation of multiple files for exfiltration in a scalable manner.[Cybereason StealBit Exfiltration Tool]
  

  Exact relationship: relationship--27e71f08-221a-47cf-a583-b32c2db001ee
• S1229 Havoc — malware.

  The Havoc SMB demon can use named pipes for communication through a parent demon.[Havoc Framework Documentation]

  Exact relationship: relationship--22f3b02d-e475-4d42-b4ae-b63da598e060
• S1239 TONESHELL — malware.

  TONESHELL has facilitated inter-process communication between DLL components via the use of pipes.[Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023] TONESHELL has also created a reverse shell using two anonymous pipes to write data to stdin and read data from stdout and stderr.[2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA]

  Exact relationship: relationship--ec6b9512-b23a-4aac-87b8-b5c4c19493de
• S1244 Medusa Ransomware — malware.

  Medusa Ransomware has leveraged the `CreatePipe` API to enable inter-process communication.[Security Scorecard Medusa Ransomware January 2024]

  Exact relationship: relationship--9d753094-3f5a-4d38-88dd-13289e1d8318
• S9024 SPAWNCHIMERA — malware.

  SPAWNCHIMERA has leveraged IPC using a UNIX domain socket between the dsmdm process and the web process.[Google UNC5221 BRICKSTORM SPAWNCHIMERA April 2024][JPCERT SPAWNCHIMERA Ivanti February 2025]

  Exact relationship: relationship--a65e797a-d529-427b-82aa-33edf4ead0a2
• S9043 Mini Shai-Hulud — malware.

  Mini Shai-Hulud has executed via the use of `subprocess.run` and fed input through standard input `stdin` which acted as a pipe to send data from the parent process and the child process `sys.executable` within memory.[Trend Micro TeamPCP MAY 2026][Hunt.io TeamPCP Toolkit MAY 2026]

  Exact relationship: relationship--d3e1a3fd-c00a-47b5-9a51-29546f6519e3
• S9062 MiniBrowse — malware.

  MiniBrowse has sent JSON files to a named pipe.[CheckPoint_NimbusManticoreEurope_Sept2025]

  Exact relationship: relationship--32ebbca7-d489-4810-a129-6019dccf42a0

Creates a named pipe using PowerShell. Named pipes are a common inter-process communication mechanism
that adversaries use to facilitate data exchange between processes or as a command-and-control channel.

Pinned Atomic procedure · 17521690-2183-460f-a182-5dfd6f9f0a7f · windows · powershell.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

Source-defined inputs

• pipe_name: Name of the named pipe to create (without the \\.\pipe\ prefix) (type string; source default atomic_pipe)

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Uses the Named Pipes Micro Emulation executable from the Center for Threat Informed Defense to create a named pipe for inter-process communication.

The named pipe executable will pause for 30 seconds to allow the client and server to exchange a message through the pipe.

Pinned Atomic procedure · 7a48f482-246f-4aeb-9837-21c271ebf244 · windows · command_prompt.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

1 prerequisite definitions:

• Named pipe executors must exist on disk

Emulates the server-side behavior of Turla's RPC backdoors. First checks to see if the named pipe atctl is in the
registry key for NullSessionPipes, and if so, modifies the security descriptor of the pipe to allow untrusted/anonymous
integrity level callers via SetSecurityInfo. Essentially allows unauthenticated users to have privileged RCE on the server machine through RPC.

Reference: https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/

Pinned Atomic procedure · 7a8f8ae9-6b1d-4f7b-88e7-9ea01234eee5 · windows · powershell.

Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

Source-defined inputs

• pipe_name: Name of the named pipe to create (type string; source default atctl)

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

1 prerequisite definitions:

• NullSessionPipes must contain the pipe name for the security descriptor to be set

Uses the Named Pipes Micro Emulation executable from the Center for Threat Informed Defense to create a named pipe for inter-process communication.

The named pipe executable will pause for 30 seconds to allow the client and server to exchange a message through the pipe.

Pinned Atomic procedure · 830c8b6c-7a70-4f40-b975-8bbe74558acd · windows · command_prompt.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

1 prerequisite definitions:

• Named pipe executors must exist on disk

Uses the Named Pipes Micro Emulation executable from the Center for Threat Informed Defense to create a named pipe for inter-process communication.

The named pipe executable will pause for 30 seconds to allow the client and server to exchange a message through the pipe.

Pinned Atomic procedure · 8dbfc15c-527b-4ab0-a272-019f469d367f · windows · command_prompt.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

1 prerequisite definitions:

• Named pipe executors must exist on disk

Uses the Named Pipes Micro Emulation executable from the Center for Threat Informed Defense to create a named pipe for inter-process communication.

The named pipe executable will pause for 30 seconds to allow the client and server to exchange a message through the pipe.

Pinned Atomic procedure · bd13b9fc-b758-496a-b81a-397462f82c72 · windows · command_prompt.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

1 prerequisite definitions:

• Named pipe executors must exist on disk

Uses the Named Pipes Micro Emulation executable from the Center for Threat Informed Defense to create a named pipe for inter-process communication.

The named pipe executable will pause for 30 seconds to allow the client and server to exchange a message through the pipe.

Pinned Atomic procedure · d1f72fa0-5bc2-4b4b-bd1e-43b6e8cfb2e6 · windows · command_prompt.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

1 prerequisite definitions:

• Named pipe executors must exist on disk

• M1013 Application Developer Guidance

  Enable the Hardened Runtime capability when developing applications. Do not include the <code>com.apple.security.get-task-allow</code> entitlement with the value set to any variation of true.

• M1026 Privileged Account Management

  Modify Registry settings (directly or using Dcomcnfg.exe) in `HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AppID_GUID}` associated with the process-wide security of individual COM applications.[Microsoft Process Wide Com Keys]

  Modify Registry settings (directly or using Dcomcnfg.exe) in `HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole` associated with system-wide security defaults for all COM applications that do no set their own process-wide security.[Microsoft System Wide Com Keys] [Microsoft COM ACL]

• M1040 Behavior Prevention on Endpoint

  On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent DDE attacks and spawning of child processes from Office programs.[Microsoft ASR Nov 2017][Enigma Reviving DDE Jan 2018]

• M1042 Disable or Remove Feature or Program

  Registry keys specific to Microsoft Office feature control security can be set to disable automatic DDE/OLE execution. [Microsoft DDE Advisory Nov 2017][BleepingComputer DDE Disabled in Word Dec 2017][GitHub Disable DDEAUTO Oct 2017] Microsoft also created, and enabled by default, Registry keys to completely disable DDE execution in Word and Excel.[Microsoft ADV170021 Dec 2017]

• M1048 Application Isolation and Sandboxing

  Ensure all COM alerts and Protected View are enabled.[Microsoft Protected View]

• M1054 Software Configuration

  Consider disabling embedded files in Office programs, such as OneNote, that do not work with Protected View.[Enigma Reviving DDE Jan 2018][GitHub Disable DDEAUTO Oct 2017]