Unusual Child Process spawned using DDE exploit

Hypothesis and description

Adversaries may use Windows Dynamic Data Exchange (DDE) to execute arbitrary commands. DDE is a client-server protocol for one-time and/or continuous inter-process communication (IPC) between applications. Once a link is established, applications can autonomously exchange transactions consisting of strings, warm data links (notifications when a data item changes), hot data links (duplications of changes to a data item), and requests for command execution.

Platforms: Windows
Domain: Host
Subtypes: Process
Submitted: 2020-12-03
Contributors: Cyware Labs

ATT&CK coverage

Technique	Tactics	Coverage
T1559 Inter-Process CommunicationT1559.002	Execution	Low

1 technique, 2 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.

T1559Inter-Process Communication
.002 Dynamic Data Exchange

D3FEND techniques MITRE maps to this analytic

D3-PSA Process Spawn Analysis

Data model references

Fields from the CAR data model (object/action/field) the analytic reads.

process/create/command_line

Pseudocode and implementations

PseudocodeSplunk search - Unusual Child Process spawned using DDE exploit

This Splunk query looks for any executable invocations from an Excel file.

processes = search Process:Create
target_processes = filter processes where (
     (parent_image="*excel.exe" OR parent_image="*word.exe" OR parent_image="*outlook.exe")
     AND image="*.exe"
     )

SplunkSplunk search - Unusual Child Process spawned using DDE exploitData model: Sysmon native

This Splunk query looks for any executable invocations from an Excel file.

index = __your_sysmon__index__ (ParentImage="*excel.exe" OR ParentImage="*word.exe" OR ParentImage="*outlook.exe") Image="*.exe"

View CAR-2021-01-006 on car.mitre.org

Hypothesis and description

Technique

Tactics

Coverage

T1559 Inter-Process CommunicationT1559.002

Execution

Low

Pseudocode and implementations

PseudocodeSplunk search - Unusual Child Process spawned using DDE exploit

This Splunk query looks for any executable invocations from an Excel file.

processes = search Process:Create
target_processes = filter processes where (
     (parent_image="*excel.exe" OR parent_image="*word.exe" OR parent_image="*outlook.exe")
     AND image="*.exe"
     )

SplunkSplunk search - Unusual Child Process spawned using DDE exploitData model: Sysmon native

This Splunk query looks for any executable invocations from an Excel file.

index = __your_sysmon__index__ (ParentImage="*excel.exe" OR ParentImage="*word.exe" OR ParentImage="*outlook.exe") Image="*.exe"