Dynamic Data Exchange

Adversaries may use Windows Dynamic Data Exchange (DDE) to execute arbitrary commands. DDE is a client-server protocol for one-time and/or continuous inter-process communication (IPC) between applications. Once a link is established, applications can autonomously exchange transactions consisting of strings, warm data links (notifications when a data item changes), hot data links (duplications of changes to a data item), and requests for command execution. Object Linking and Embedding (OLE), or the ability to link data between documents, was originally implemented through DDE. Despite being superseded by Component Object Model, DDE may be enabled in Windows 10 and most of Microsoft Office 2016 via Registry keys.¹²³ Microsoft Office documents can be poisoned with DDE commands, directly or through embedded files, and used to deliver execution via Phishing campaigns or hosted Web content, avoiding the use of Visual Basic for Applications (VBA) macros.⁴⁵⁶⁷ Similarly, adversaries may infect payloads to execute applications and/or commands on a victim device by way of embedding DDE formulas within a CSV file intended to be opened through a Windows spreadsheet program.⁸⁹ DDE could also be leveraged by an adversary operating on a compromised machine who does not have direct access to a Command and Scripting Interpreter. DDE execution can be invoked remotely via Remote Services such as Distributed Component Object Model (DCOM).¹⁰

1. BleepingComputer DDE Disabled in Word Dec 2017
2. Microsoft ADV170021 Dec 2017
3. Microsoft DDE Advisory Nov 2017
4. SensePost PS DDE May 2016
5. Kettle CSV DDE Aug 2014
6. Enigma Reviving DDE Jan 2018
7. SensePost MacroLess DDE Oct 2017
8. OWASP CSV Injection
9. CSV Excel Macro Injection
10. Fireeye Hunting COM June 2019

使用该技术的组织

断言

尚无指向该技术的公开断言。

记录自动入库·未人工复核；置信度与有效期按引用读取。