D3-IPCTA

Detect
IPC Traffic Analysis

Definition

Analyzing standard inter process communication (IPC) protocols to detect deviations from normal protocol activity.

How it works

Inter process communication enables applications or threads to share data. This can involve one or more computers. Monitoring IPC in your environment can reveal abnormal or malicious activity.

IPC can occur within a single computer or between multiple computers remotely through network protocols. Thus there are multiple ways to collect and monitor these exchanges between processes. A network protocol analyzer may monitor and parse SMB network traffic to record system activity. A host based monitoring agent may monitor IPC activity contained within a single host to look for deviations from standard usages.

Examples

•SMB

•Zeromq

•Java RMI API

Considerations

•IPC can generate substantial amounts of data, and it may not be feasible to collect all of it.

•IPC may occur over loopback interfaces or direct memory access granted by the operating system.

Artifact Relationships

This defensive technique relates to specific digital artifacts.

analyzes
IPC Traffic Analysis
Intranet IPC Network Traffic

References

Reference - CAR-2015-04-001: Remotely Scheduled Tasks via AT - MITRE Reference - CAR-2013-05-005: SMB Copy and Execution - MITRE Reference - CAR-2013-01-003: SMB Events Monitoring - MITRE Reference - CAR-2013-09-003: SMB Session Setups - MITRE Reference - CAR-2014-03-001: SMB Write Request - NamedPipes - MITRE Reference - CAR-2013-05-003: SMB Write Request - MITRE Reference - Security System with Methodology for Interprocess Communication Control - Check Point Software Tech Inc