T1559.002 — Dynamic Data Exchange

T1559.002 Inter-Process Communication: Dynamic Data Exchange

title: "T1559.002 Inter-Process Communication: Dynamic Data Exchange"
id: 670ee2b1-5e31-4f9a-b3d8-296bb291bded
description: 'Detect Abuse of Dynamic Data Exchange (T1559.002). (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: AllowedParentChildPairs, TimeWindow, SuspiciousDLLList.'
references:
  - https://attack.mitre.org/techniques/T1559/002
author: Shahrukh Khan
date: 2026-06-08
license: MIT
tags:
  - attack.execution
  - attack.t1559.002

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection_office_parent:
    ParentImage|endswith:
      - '\winword.exe'
      - '\excel.exe'
      - '\outlook.exe'
      - '\powerpnt.exe'

  selection_shell_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\powershell_ise.exe'
      - '\mshta.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'

  condition: selection_office_parent and selection_shell_child

falsepositives:
  - Legitimate mail-merge, document-automation, or add-in workflows that spawn helper processes directly from an Office application.

level: medium