| ID |
C0003 |
| Objective(s) |
Communication |
| Related ATT&CK Techniques |
None |
| Version |
2.2 |
| Created |
14 August 2020 |
| Last Modified |
30 April 2024 |
The Interprocess Communication micro-behavior focuses on interprocess communication.
| Name | ID | Description |
|---|
| Connect Pipe | C0003.002 | -- |
| Create Pipe | C0003.001 | -- |
| Read Pipe | C0003.003 | -- |
| Write Pipe | C0003.004 | -- |
| Name | Date | Method | Description |
|---|
| Hupigon | 2013 | C0003.001 | Hupigon creates two anonymous pipes. [1] |
| Hupigon | 2013 | C0003.004 | Hupigon writes pipes. [1] |
| Poison Ivy | 2005 | C0003.004 | Poison Ivy writes pipes. [1] |
| Tool: capa | Mapping | APIs |
|---|
| create mailslot | Interprocess Communication (C0003) | kernel32.CreateMailslot, kernel32.GetMailslotInfo, kernel32.SetMailslotInfo |
| read from mailslot | Interprocess Communication (C0003) | kernel32.GetMailslotInfo, kernel32.ReadFile, kernel32.ReadFileEx |
| create pipe | Interprocess Communication::Create Pipe (C0003.001) | kernel32.CreatePipe, kernel32.CreateNamedPipe, System.IO.Pipes.AnonymousPipeClientStream::ctor, System.IO.Pipes.NamedPipeClientStream::ctor, System.IO.Pipes.AnonymousPipeServerStream::ctor, System.IO.Pipes.AnonymousPipeServerStreamAcl::Create, System.IO.Pipes.NamedPipeServerStream::ctor, System.IO.Pipes.NamedPipeServerStreamAcl::Create |
| create two anonymous pipes | Interprocess Communication::Create Pipe (C0003.001) | -- |
| write pipe | Interprocess Communication::Write Pipe (C0003.004) | kernel32.WriteFile, kernel32.TransactNamedPipe, kernel32.CallNamedPipe |
| connect pipe | Interprocess Communication::Connect Pipe (C0003.002) | kernel32.ConnectNamedPipe, kernel32.CallNamedPipe, System.IO.Pipes.NamedPipeClientStream::Connect, System.IO.Pipes.NamedPipeClientStream::ConnectAsync |
| read pipe | Interprocess Communication::Read Pipe (C0003.003) | kernel32.PeekNamedPipe, kernel32.ReadFile, kernel32.TransactNamedPipe, kernel32.CallNamedPipe |
| Tool: CAPE | Class | Mapping | APIs |
|---|
| ipc_namedpipe | IPC_NamedPipe | Interprocess Communication (C0003) | NtReadFile, NtCreateNamedPipeFile, NtWriteFile |
| ipc_namedpipe | IPC_NamedPipe | Interprocess Communication::Create Pipe (C0003.001) | NtReadFile, NtCreateNamedPipeFile, NtWriteFile |
Communication::Interprocess Communication::Connect Pipe
SHA256: e5897829835f3e9fbab71674ca06f48ff127ec014d1629817f0566203c93b732
Location: 0x40167C
call qword ptr [->KERNEL32.DLL::CreateNamedPipeA] ; stores return value in rax
mov r12, rax ; r12 now contains a handle to the named pipe
lea rax, [rax + -0x1]
cmp rax, -0x3
ja LAB_004016dc
xor param_2, param_2 ; set value to zeroes. param_2 is edx, which is sometimes used to hold the second argument to a function
mov param_1, r12 ; param_1 is rcx, which is sometimes used to hold the first argument to a function. r12 contains the return value from KERNEL32.DLL::CreateNamedPipeA (see earlier mov instruction)
lea rdi, [rsp + 0x4c]
call qword ptr [->KERNEL32.DLL::ConnectNamedPipe] ; takes param_1 and param_2 as arguments. Return value stored in rax.
[1] capa v4.0, analyzed at MITRE on 10/12/2022