进程间通信

Sub-techniques (4)

ID	Name
T1559.001	内存驻留IPC注入
T1559.002	命名管道伪装通信
T1559.003	COM组件劫持重定向
T1559.004	动态协议自适应切换

进程间通信（IPC）是攻击者滥用操作系统提供的进程交互机制执行恶意代码的技术，常通过组件对象模型（COM）、动态数据交换（DDE）等接口实现本地或远程代码执行。防御方通常监控异常进程创建事件、非常规DLL加载行为以及非常用IPC通道的建立，通过分析CLSID注册表修改日志和RPC接口调用模式来检测潜在攻击。

为规避传统检测手段，攻击者发展出深度融入系统架构的IPC匿迹技术，通过内存化执行、协议仿真、组件劫持和多协议动态切换等手法，将恶意通信行为伪装成合法的系统进程交互，显著提升攻击链的隐蔽性和持久性。

当前IPC匿迹技术的演进呈现三大特征：首先，利用系统信任机制实现身份伪装，通过劫持数字签名组件或继承系统服务权限，使恶意通信获得合法身份背书；其次，突破传统进程间通信的时空限制，采用内存驻留技术消除磁盘痕迹，结合低频异步通信机制规避实时监控；最后，构建协议自适应体系，根据防御环境动态调整通信协议栈，利用多层协议封装和加密隧道实现流量特征混淆。四项子技术均遵循"最小化异常特征"原则——内存驻留注入消除文件特征、命名管道伪装匹配协议规范、COM劫持继承信任链条、协议切换破坏模式识别，形成多维立体的隐蔽通信矩阵。

匿迹技术的应用导致传统基于签名检测和静态协议分析的防御手段逐渐失效，防御方需加强进程行为基线建模、运行时内存取证分析和跨协议关联检测能力，结合机器学习算法识别异常组件加载模式，并通过硬件虚拟化技术监控底层IPC通道的异常调用链。

ID: T1559

Sub-techniques: T1559.001, T1559.002, T1559.003, T1559.004

ⓘ

Tactic: 攻击执行

ⓘ

Platforms: Linux, Windows, macOS

ⓘ

Supports Remote: Yes

Version: 1.3

Created: 12 February 2020

Last Modified: 10 September 2024

匿迹效应

效应类型	是否存在
特征伪装	✅
行为透明	✅
数据遮蔽	✅
时空释痕	✅

特征伪装

通过精确仿冒系统组件的通信协议格式和命名规范，使恶意IPC流量在协议结构、数据封装、交互时序等维度与合法流量高度一致。例如命名管道伪装技术完全复现系统服务管道的通信特征，使得基于协议特征匹配的检测系统无法有效区分。

行为透明

利用零日漏洞或未公开的COM接口实现代码执行，规避基于已知攻击模式的检测。如通过劫持未文档化的CLSID实现隐蔽提权，传统基于公开接口监控的防御体系难以察觉异常行为。

数据遮蔽

采用进程内存加密通信或协议隧道嵌套技术，对传输的指令和数据进行多层加密。例如在DCOM通信中嵌套TLS会话，使得网络流量捕获设备无法解析有效载荷内容。

时空释痕

通过动态协议切换和低频异步通信机制，将连续攻击行为分解为离散事件。如自适应协议技术根据网络负载状况随机调整通信间隔，使得基于时间序列分析的检测模型难以建立有效行为基线。

Procedure Examples

ID	Name	Description
S0687	Cyclops Blink	Cyclops Blink has the ability to create a pipe to enable inter-process communication.^[1]
S0537	HyperStack	HyperStack can connect to the IPC$ share on remote machines.^[2]
S1141	LunarWeb	LunarWeb can retrieve output from arbitrary processes and shell commands via a pipe.^[3]
S1100	Ninja	Ninja can use pipes to redirect the standard input and the standard output.^[4]
S1123	PITSTOP	PITSTOP can listen over the Unix domain socket located at `/data/runtime/cockpit/wd.fd`.^[5]
S1130	Raspberry Robin	Raspberry Robin contains an embedded custom Tor network client that communicates with the primary payload via shared process memory.^[6]
S1150	ROADSWEEP	ROADSWEEP can pipe command output to a targeted process.^[7]
S1078	RotaJakiro	When executing with non-root permissions, RotaJakiro uses the the `shmget API` to create shared memory between other known RotaJakiro processes. This allows processes to communicate with each other and share their PID.^[8]
S0022	Uroburos	Uroburos has the ability to move data between its kernel and user mode components, generally using named pipes.^[9]

Mitigations

ID	Mitigation	Description
M1013	Application Developer Guidance	Enable the Hardened Runtime capability when developing applications. Do not include the `com.apple.security.get-task-allow` entitlement with the value set to any variation of true.
M1048	Application Isolation and Sandboxing	Ensure all COM alerts and Protected View are enabled.^[10]
M1040	Behavior Prevention on Endpoint	On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent DDE attacks and spawning of child processes from Office programs.^[11]^[12]
M1042	Disable or Remove Feature or Program	Registry keys specific to Microsoft Office feature control security can be set to disable automatic DDE/OLE execution. ^[13]^[14]^[15] Microsoft also created, and enabled by default, Registry keys to completely disable DDE execution in Word and Excel.^[16]
M1026	Privileged Account Management	Modify Registry settings (directly or using Dcomcnfg.exe) in `HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AppID_GUID}` associated with the process-wide security of individual COM applications.^[17] Modify Registry settings (directly or using Dcomcnfg.exe) in `HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole` associated with system-wide security defaults for all COM applications that do no set their own process-wide security.^[18] ^[19]
M1054	Software Configuration	Consider disabling embedded files in Office programs, such as OneNote, that do not work with Protected View.^[12]^[15]

Detection

ID	Data Source	Data Component	Detects
DS0011	Module	Module Load	Monitor for the loading of unusual modules or DLLs into processes. Specifically focus on modules that are not typically loaded or associated with IPC mechanisms. Analytic 1 - Unrecognized DLLs. `sourcetype=Sysmon EventCode=7\| search module_path != "/usr/lib/" OR module_path != "/windows/system32/" OR module_path != "/lib/*"\| stats count by module_path process_name user\| where module_path IN ("suspicious_modules.dll", "unknown.so")`
DS0009	Process	Process Access	Monitor processes that attempt to access other processes, especially if the access is unusual (such as low-privileged processes interacting with high-privileged processes like a VPN service).^[20] Analytic 1 - Abnormal process access. `sourcetype=Sysmon EventCode=10\| search access_type="IPC" AND process_privilege!="high"\| stats count by process_name target_process_name user\| where target_process_name IN ("VPNService", "Systemd", "svchost.exe")`
		Process Creation	Monitor the creation of processes that are related to the abuse of IPC mechanisms, particularly those that communicate with higher-privileged services or perform suspicious operations. Analytic 1 - Processes using IPC mechanisms. `(( sourcetype=WinEventLog:Security EventCode=4688) OR (sourcetype=Sysmon EventCode=1))\| search parent_process IN ("XPCService", "com.apple.securityd") OR process_name IN ("cmd.exe", "bash", "osascript")`
DS0012	Script	Script Execution	Monitor for any attempts to enable scripts running on a system would be considered suspicious. If scripts are not commonly used on a system, but enabled, scripts running out of cycle from patching or other administrator functions are suspicious. Scripts should be captured from the file system when possible to determine their actions and intent.