T1559.002sub-technique of T1559 Inter-Process Communication
Dynamic Data Exchange
Windowsnothing on this site yetT1559.002 on attack.mitre.org
Adversaries may use Windows Dynamic Data Exchange (DDE) to execute arbitrary commands. DDE is a client-server protocol for one-time and/or continuous inter-process communication (IPC) between applications. Once a link is established, applications can autonomously exchange transactions consisting of strings, warm data links (notifications when a data item changes), hot data links (duplications of changes to a data item), and requests for command execution.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Playbook for this stage
Suspicious execution on an endpoint
An EDR alert, an unexplained process, or a user reporting something odd.
how MITRE says to see it
Detect Abuse of Dynamic Data Exchange (T1559.002)
- Detects anomalous use of Dynamic Data Exchange (DDE) for code execution, such as Office applications (WINWORD.EXE, EXCEL.EXE) spawning command interpreters, or loading unusual modules through DDEAUTO/DDE formulas.
what reduces it
- M1040 Behavior Prevention on Endpoint. On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent DDE attacks and spawning of child processes from Office programs.
- M1054 Software Configuration. Consider disabling embedded files in Office programs, such as OneNote, that do not work with Protected View.
- M1048 Application Isolation and Sandboxing. Ensure Protected View is enabled.
- M1042 Disable or Remove Feature or Program. Registry keys specific to Microsoft Office feature control security can be set to disable automatic DDE/OLE execution. Microsoft also created, and enabled by default, Registry keys to completely disable DDE execution in Word and Excel.