Sub-technique of T1559 Inter-Process Communication.View on attack.mitre.org
Adversaries may use Windows Dynamic Data Exchange (DDE) to execute arbitrary commands. DDE is a client-server protocol for one-time and/or continuous inter-process communication (IPC) between applications. Once a link is established, applications can autonomously exchange transactions consisting of strings, warm data links (notifications when a data item changes), hot data links (duplications of changes to a data item), and requests for command execution.
Object Linking and Embedding (OLE), or the ability to link data between documents, was originally implemented through DDE. Despite being superseded by Component Object Model, DDE may be enabled in Windows 10 and most of Microsoft Office 2016 via Registry keys.
Microsoft Office documents can be poisoned with DDE commands, directly or through embedded files, and used to deliver execution via Phishing campaigns or hosted Web content, avoiding the use of Visual Basic for Applications (VBA) macros. Similarly, adversaries may infect payloads to execute applications and/or commands on a victim device by way of embedding DDE formulas within a CSV file intended to be opened through a Windows spreadsheet program.
DDE could also be leveraged by an adversary operating on a compromised machine who does not have direct access to a Command and Scripting Interpreter. DDE execution can be invoked remotely via Remote Services such as Distributed Component Object Model (DCOM).
Rules on DetectionCode tagged with T1559.002.
| Rule | Level | Log source |
|---|---|---|
| Enable Microsoft Dynamic Data Exchange | medium | windows / registry_set |
| Used by | Procedure example |
|---|---|
| GroupAPT28 | APT28 has delivered JHUHUGIT and Koadic by executing PowerShell commands through DDE in Word documents. |
| GroupAPT37 | APT37 has used Windows DDE for execution of commands and a malicious VBS. |
| GroupBITTER | BITTER has executed OLE objects using Microsoft Equation Editor to download and run malicious payloads. |
| GroupCobalt Group | Cobalt Group has sent malicious Word OLE compound documents to victims. |
| GroupFIN7 | FIN7 spear phishing campaigns have included malicious Word documents with DDE execution. |
| GroupGallmaker | Gallmaker attempted to exploit Microsoft’s DDE protocol in order to gain access to victim machines and for execution. |
| GroupLeviathan | Leviathan has utilized OLE as a method to insert malicious content inside various phishing documents. |
| GroupMuddyWater | MuddyWater has used malware that can execute PowerShell scripts via DDE. |
| Used by | Procedure example |
|---|---|
| MalwareGravityRAT | GravityRAT has been delivered via Word documents using DDE for execution. |
| MalwareHAWKBALL | HAWKBALL has used an OLE object that uses Equation Editor to drop the embedded shellcode. |
| MalwareKeyBoy | KeyBoy uses the Dynamic Data Exchange (DDE) protocol to download remote payloads. |
| MalwarePoetRAT | PoetRAT was delivered with documents using DDE to execute malicious code. |
| MalwarePOWERSTATS | POWERSTATS can use DDE to execute additional payloads on compromised hosts. |
| MalwareRamsay | Ramsay has been delivered using OLE objects in malicious documents. |
| MalwareRTM | RTM can search for specific strings within browser tabs using a Dynamic Data Exchange mechanism. |
| MalwareValak | Valak can execute tasks via OLE. |
| Used by | Procedure example |
|---|---|
| CampaignOperation Sharpshooter | During Operation Sharpshooter, threat actors sent malicious Word OLE documents to victims. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
