LiveActive security incident?Get immediate response
MITRE ATT&CK® Technique

T1559.002: Dynamic Data Exchange

Adversaries may use Windows Dynamic Data Exchange (DDE) to execute arbitrary commands. DDE is a client-server protocol for one-time and/or continuous inter-process communication (IPC) between applications. Once a link is established, applications can autonomously exchange transactions consisting of strings, warm data links (notifications when a data item changes), hot data links (duplications of changes to a data item), and requests for command execution.

Object Linking and Embedding (OLE), or the ability to link data between documents, was originally implemented through DDE. Despite being superseded by Component Object Model, DDE may be enabled in Windows 10 and most of Microsoft Office 2016 via Registry keys.[1][2][3]

Microsoft Office documents can be poisoned with DDE commands, directly or through embedded files, and used to deliver execution via Phishing campaigns or hosted Web content, avoiding the use of Visual Basic for Applications (VBA) macros.[4][5][6][7] Similarly, adversaries may infect payloads to execute applications and/or commands on a victim device by way of embedding DDE formulas within a CSV file intended to be opened through a Windows spreadsheet program.[8][9]

DDE could also be leveraged by an adversary operating on a compromised machine who does not have direct access to a Command and Scripting Interpreter. DDE execution can be invoked remotely via Remote Services such as Distributed Component Object Model (DCOM).[10]

EnterpriseT1559.002Sub-techniqueObject v1.4Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceHigh

Dynamic Data Exchange is a legacy Windows inter-process communication feature that can turn Office documents or spreadsheet/CSV content into an execution path without relying on VBA macros. For leaders, the practical risk is that “macro controls” alone may not close document-based execution exposure, especially where older Office behaviors, registry settings, or business processes require opening untrusted documents.

Executive priority

Prioritize this where Windows endpoints and Microsoft Office document workflows are important to operations, especially teams exposed to phishing, hosted document content, or externally supplied CSV files. The key decision is whether the business still needs DDE-enabled behavior; if not, disabling or tightly configuring it provides clearer risk reduction than relying only on user training or signature-based detection. This technique also matters for audit and incident readiness because defenders need evidence that endpoint behavior prevention, application configuration, and document-handling controls address macro-less execution paths.

Technical view

This is a Windows execution sub-technique under Inter-Process Communication. ATT&CK notes DDE can execute arbitrary commands through Office documents, embedded files, CSV formulas opened in spreadsheet software, or remotely through services such as DCOM. MITRE does not provide official detection text for this object, but the related detection strategy DET0504 indicates detection should focus on abuse of DDE. SOC and IR teams should validate visibility into Office or spreadsheet processes initiating command interpreters, scripting engines, unusual child processes, or remote execution chains, and should compare findings against approved business uses of DDE/OLE-style document linking.

Likely telemetry

  • Windows endpoint process creation and command-line events
  • Parent-child process relationships involving Office or spreadsheet applications
  • Document, embedded file, and CSV handling evidence from email, web, or endpoint controls
  • Registry or software configuration state related to DDE/Office behavior
  • Endpoint behavior-prevention alerts for suspicious process behavior

Detection direction

  • Validate whether detections cover macro-less document execution, not only VBA macro behavior.
  • Tune for suspicious Office or spreadsheet application child processes while accounting for legitimate automation, document linking, and business reporting workflows.
  • Use DET0504 as the ATT&CK-linked detection strategy and test whether it produces useful evidence in the local Windows and Office configuration baseline.
  • Correlate document delivery context, such as phishing or hosted web content, with endpoint execution telemetry.
  • Review blind spots where command-line logging, process lineage, registry visibility, or Office document inspection is incomplete.

Mitigation priorities

  • First determine whether DDE or legacy Office linking behavior is required for business workflows.
  • If not required, use Disable or Remove Feature or Program and Software Configuration controls to reduce or disable the exposed functionality where supported.
  • Apply Behavior Prevention on Endpoint to block suspicious process behavior associated with document-driven command execution.
  • Use Application Isolation and Sandboxing for risky document and web-content handling paths to limit system impact.
  • Document control decisions and exceptions so compliance, SOC, and IR teams can distinguish accepted business use from abnormal execution behavior.
Additional notes and limits

The relationship set shows this technique has been used by multiple ATT&CK groups, a campaign, and Windows malware families, which supports treating it as a recurring tradecraft pattern rather than a one-off feature abuse. Those relationships should inform threat modeling and detection test cases, but they do not prove current activity in any specific environment.

MITRE provides no official detection procedure for this object, and the supplied data does not include specific event IDs, product logic, or guaranteed control outcomes. Local Windows version, Office version, registry configuration, document workflows, and telemetry quality determine actual exposure and detection coverage.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Dynamic Data Exchange

Adversaries may use Windows Dynamic Data Exchange (DDE) to execute arbitrary commands. DDE is a client-server protocol for one-time and/or continuous inter-process communication (IPC) between applications. Once a link is established, applications can autonomously exchange transactions consisting of strings, warm data links (notifications when a data item changes), hot data links (duplications of changes to a data item), and requests for command execution.

Object Linking and Embedding (OLE), or the ability to link data between documents, was originally implemented through DDE. Despite being superseded by Component Object Model, DDE may be enabled in Windows 10 and most of Microsoft Office 2016 via Registry keys.[1][2][3]

Microsoft Office documents can be poisoned with DDE commands, directly or through embedded files, and used to deliver execution via Phishing campaigns or hosted Web content, avoiding the use of Visual Basic for Applications (VBA) macros.[4][5][6][7] Similarly, adversaries may infect payloads to execute applications and/or commands on a victim device by way of embedding DDE formulas within a CSV file intended to be opened through a Windows spreadsheet program.[8][9]

DDE could also be leveraged by an adversary operating on a compromised machine who does not have direct access to a Command and Scripting Interpreter. DDE execution can be invoked remotely via Remote Services such as Distributed Component Object Model (DCOM).[10]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Related techniques

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

2 rows
DomainIDNameRelationship / procedure
EnterpriseT1559Inter-Process CommunicationThis object subtechnique of Inter-Process Communication.
EnterpriseT1173Dynamic Data ExchangeDynamic Data Exchange revoked by this object.
Associated objects

Groups, software, and campaigns

GroupEnterprise

G0080: Cobalt Group

Cobalt Group is a financially motivated threat group that has primarily targeted financial institutions since at least 2016. The group has conducted intrusions to steal money via targeting ATM systems, card processing, payment systems and SWIFT systems. Cobalt Group has mainly targeted banks in Eastern Europe, Central Asia, and Southeast Asia. One of the alleged leaders was arrested in Spain in early 2018, but the group still appears to be active. The group has been known to target organizations in order to use their access to then compromise additional victims.[1][2][3][4][5][6][7] Reporting indicates there may be links between Cobalt Group and both the malware Carbanak and the group Carbanak.[8]

GroupEnterprise

G0046: FIN7

FIN7 is a financially-motivated threat group that has been active since 2013. FIN7 has targeted the retail, restaurant, hospitality, software, consulting, financial services, medical equipment, cloud services, media, food and beverage, transportation, pharmaceutical, and utilities industries in the United States. A portion of FIN7 was operated out of a front company called Combi Security and often used point-of-sale malware for targeting efforts. Since 2020, FIN7 shifted operations to big game hunting (BGH), including use of REvil ransomware and their own Ransomware-as-a-Service (RaaS), Darkside. FIN7 may be linked to the Carbanak Group, but multiple threat groups have been observed using Carbanak, leading these groups to be tracked separately.[1][2][3][4][5][6][7]

GroupEnterprise

G0069: MuddyWater

MuddyWater is a cyber espionage group assessed to be a subordinate element within Iran's Ministry of Intelligence and Security (MOIS).[1] Since at least 2017, MuddyWater has targeted a range of government and private organizations across sectors, including telecommunications, local government, finance, defense, and oil and natural gas organizations, in the Middle East (specifically the UAE and Saudi Arabia), Asia, Africa, Europe, and North America. MuddyWater has reused domains dating back to October 2025, and has a preference for NameCheap and Hosterdaddy Private Limited (AS136557). In late 2025 and early 2026, MuddyWater used commercial satellite internet (i.e., Starlink) for command and control (C2) communication. [2][3][4][5][6][7][8][9][10][11][12][13]

GroupEnterprise

G0121: Sidewinder

Sidewinder is a suspected Indian threat actor group that has been active since at least 2012. They have been observed targeting government, military, and business entities throughout Asia, primarily focusing on Pakistan, China, Nepal, and Afghanistan.[1][2][3]

GroupEnterprise

G0007: APT28

APT28 is a threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS) military unit 26165.[1][2] This group has been active since at least 2004.[3][4][5][6][7][8][9][10][11][12][13]

APT28 reportedly compromised the Hillary Clinton campaign, the Democratic National Committee, and the Democratic Congressional Campaign Committee in 2016 in an attempt to interfere with the U.S. presidential election.[5] In 2018, the US indicted five GRU Unit 26165 officers associated with APT28 for cyber operations (including close-access operations) conducted between 2014 and 2018 against the World Anti-Doping Agency (WADA), the US Anti-Doping Agency, a US nuclear facility, the Organization for the Prohibition of Chemical Weapons (OPCW), the Spiez Swiss Chemicals Laboratory, and other organizations.[14] Some of these were conducted with the assistance of GRU Unit 74455, which is also referred to as Sandworm Team.

GroupEnterprise

G0067: APT37

APT37 is a North Korean state-sponsored cyber espionage group that has been active since at least 2012. The group has targeted victims primarily in South Korea, but also in Japan, Vietnam, Russia, Nepal, China, India, Romania, Kuwait, and other parts of the Middle East. APT37 has also been linked to the following campaigns between 2016-2018: Operation Daybreak, Operation Erebus, Golden Time, Evil New Year, Are you Happy?, FreeMilk, North Korean Human Rights, and Evil New Year 2018.[1][2][3]

North Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name Lazarus Group instead of tracking clusters or subgroups.

GroupEnterprise

G0084: Gallmaker

Gallmaker is a cyberespionage group that has targeted victims in the Middle East and has been active since at least December 2017. The group has mainly targeted victims in the defense, military, and government sectors.[1]

GroupEnterprise

G0065: Leviathan

Leviathan is a Chinese state-sponsored cyber espionage group that has been attributed to the Ministry of State Security's (MSS) Hainan State Security Department and an affiliated front company.[1] Active since at least 2009, Leviathan has targeted the following sectors: academia, aerospace/aviation, biomedical, defense industrial base, government, healthcare, manufacturing, maritime, and transportation across the US, Canada, Australia, Europe, the Middle East, and Southeast Asia.[1][2][3][4]

GroupEnterprise

G1002: BITTER

BITTER is a suspected South Asian cyber espionage threat group that has been active since at least 2013. BITTER has targeted government, energy, and engineering organizations in Pakistan, China, Bangladesh, and Saudi Arabia.[1][2]

GroupEnterprise

G0092: TA505

TA505 is a cyber criminal group that has been active since at least 2014. TA505 is known for frequently changing malware, driving global trends in criminal malware distribution, and ransomware campaigns involving Clop.[1][2][3][4][5]

GroupEnterprise

G0040: Patchwork

Patchwork is a cyber espionage group that was first observed in December 2015. While the group has not been definitively attributed, circumstantial evidence suggests the group may be a pro-Indian or Indian entity. Patchwork has been seen targeting industries related to diplomatic and government agencies. Much of the code used by this group was copied and pasted from online forums. Patchwork was also seen operating spearphishing campaigns targeting U.S. think tank groups in March and April of 2018.[1] [2][3][4]

MalwareEnterprise

S0458: Ramsay

Ramsay is an information stealing malware framework designed to collect and exfiltrate sensitive documents, including from air-gapped systems. Researchers have identified overlaps between Ramsay and the Darkhotel-associated Retro malware.[1][2]

Windows
MalwareEnterprise

S0148: RTM

RTM is custom malware written in Delphi. It is used by the group of the same name (RTM). Newer versions of the malware have been reported publicly as Redaman.[1][2]

Windows
MalwareEnterprise

S0476: Valak

Valak is a multi-stage modular malware that can function as a standalone information stealer or downloader, first observed in 2019 targeting enterprises in the US and Germany.[1][2]

Windows
MalwareEnterprise

S0428: PoetRAT

PoetRAT is a remote access trojan (RAT) that was first identified in April 2020. PoetRAT has been used in multiple campaigns against the private and public sectors in Azerbaijan, including ICS and SCADA systems in the energy sector. The STIBNITE activity group has been observed using the malware. PoetRAT derived its name from references in the code to poet William Shakespeare. [1][2][3]

Windows
MalwareEnterprise

S0387: KeyBoy

KeyBoy is malware that has been used in targeted campaigns against members of the Tibetan Parliament in 2016.[1][2]

Windows
MalwareEnterprise

S0237: GravityRAT

GravityRAT is a remote access tool (RAT) and has been in ongoing development since 2016. The actor behind the tool remains unknown, but two usernames have been recovered that link to the author, which are "TheMartian" and "The Invincible." According to the National Computer Emergency Response Team (CERT) of India, the malware has been identified in attacks against organization and entities in India. [1]

Windows
CampaignEnterprise

C0013: Operation Sharpshooter

Operation Sharpshooter was a global cyber espionage campaign that targeted nuclear, defense, government, energy, and financial companies, with many located in Germany, Turkey, the United Kingdom, and the United States. Security researchers noted the campaign shared many similarities with previous Lazarus Group operations, including fake job recruitment lures and shared malware code.[1][2][3]

Relationship explorer

All related ATT&CK context

uses · MalwareS0458: RamsayEnterpriseuses · CampaignC0013: Operation SharpshooterEnterpriseuses · MalwareS0391: HAWKBALLEnterprisedetects · Detection StrategyDET0504: Detect Abuse of Dynamic Data Exchange (T1559.002)Enterprisemitigates · MitigationM1040: Behavior Prevention on EndpointEnterpriseuses · GroupG0080: Cobalt GroupEnterpriseuses · GroupG0046: FIN7Enterpriseuses · GroupG0069: MuddyWaterEnterpriseuses · GroupG0121: SidewinderEnterpriseuses · MalwareS0148: RTMEnterpriseuses · GroupG0007: APT28Enterpriseuses · MalwareS0476: ValakEnterpriseuses · MalwareS0428: PoetRATEnterpriseuses · GroupG0067: APT37Enterpriseuses · MalwareS0223: POWERSTATSEnterprisemitigates · MitigationM1048: Application Isolation and SandboxingEnterprisemitigates · MitigationM1054: Software ConfigurationEnterprisesubtechnique of · TechniqueT1559: Inter-Process CommunicationEnterpriseuses · GroupG0084: GallmakerEnterpriseuses · GroupG0065: LeviathanEnterpriseuses · GroupG1002: BITTEREnterpriseuses · MalwareS0387: KeyBoyEnterpriseuses · MalwareS0237: GravityRATEnterprisemitigates · MitigationM1042: Disable or Remove Feature or ProgramEnterprise
Mitigations

Mitigation direction

MitigationEnterprise

M1040: Behavior Prevention on Endpoint

Behavior Prevention on Endpoint refers to the use of technologies and strategies to detect and block potentially malicious activities by analyzing the behavior of processes, files, API calls, and other endpoint events. Rather than relying solely on known signatures, this approach leverages heuristics, machine learning, and real-time monitoring to identify anomalous patterns indicative of an attack. This mitigation can be implemented through the following measures:

Suspicious Process Behavior:

- Implementation: Use Endpoint Detection and Response (EDR) tools to monitor and block processes exhibiting unusual behavior, such as privilege escalation attempts. - Use Case: An attacker uses a known vulnerability to spawn a privileged process from a user-level application. The endpoint tool detects the abnormal parent-child process relationship and blocks the action.

Unauthorized File Access:

- Implementation: Leverage Data Loss Prevention (DLP) or endpoint tools to block processes attempting to access sensitive files without proper authorization. - Use Case: A process tries to read or modify a sensitive file located in a restricted directory, such as /etc/shadow on Linux or the SAM registry hive on Windows. The endpoint tool identifies this anomalous behavior and prevents it.

Abnormal API Calls:

- Implementation: Implement runtime analysis tools to monitor API calls and block those associated with malicious activities. - Use Case: A process dynamically injects itself into another process to hijack its execution. The endpoint detects the abnormal use of APIs like `OpenProcess` and `WriteProcessMemory` and terminates the offending process.

Exploit Prevention:

- Implementation: Use behavioral exploit prevention tools to detect and block exploits attempting to gain unauthorized access. - Use Case: A buffer overflow exploit is launched against a vulnerable application. The endpoint detects the anomalous memory write operation and halts the process.

MitigationEnterprise

M1048: Application Isolation and Sandboxing

Application Isolation and Sandboxing refers to the technique of restricting the execution of code to a controlled and isolated environment (e.g., a virtual environment, container, or sandbox). This method prevents potentially malicious code from affecting the rest of the system or network by limiting access to sensitive resources and critical operations. The goal is to contain threats and minimize their impact. This mitigation can be implemented through the following measures:

Browser Sandboxing:

- Use Case: Implement browser sandboxing to isolate untrusted web content and prevent malicious web pages or scripts from accessing sensitive system resources or initiating unauthorized downloads. - Implementation: Use browsers with built-in sandboxing features (e.g., Google Chrome, Microsoft Edge) or deploy enhanced browser security frameworks that limit the execution scope of active content. Consider controls that monitor or restrict script-based file generation and downloads commonly abused in evasion techniques like HTML smuggling.

Application Virtualization:

- Use Case: Deploy critical or high-risk applications in a virtualized environment to ensure any compromise does not affect the host system. - Implementation: Use application virtualization platforms to run applications in isolated environments.

Email Attachment Sandboxing:

- Use Case: Route email attachments to a sandbox environment to detect and block malware before delivering emails to end-users. - Implementation: Integrate security solutions with sandbox capabilities to analyze email attachments.

Endpoint Sandboxing:

- Use Case: Run all downloaded files and applications in a restricted environment to monitor their behavior for malicious activity. - Implementation: Use endpoint protection tools for sandboxing at the endpoint level.

MitigationEnterprise

M1054: Software Configuration

Software configuration refers to making security-focused adjustments to the settings of applications, middleware, databases, or other software to mitigate potential threats. These changes help reduce the attack surface, enforce best practices, and protect sensitive data. This mitigation can be implemented through the following measures:

Conduct a Security Review of Application Settings:

- Review the software documentation to identify recommended security configurations. - Compare default settings against organizational policies and compliance requirements.

Implement Access Controls and Permissions:

- Restrict access to sensitive features or data within the software. - Enforce least privilege principles for all roles and accounts interacting with the software.

Enable Logging and Monitoring:

- Configure detailed logging for key application events such as authentication failures, configuration changes, or unusual activity. - Integrate logs with a centralized monitoring solution, such as a SIEM.

Update and Patch Software Regularly:

- Ensure the software is kept up-to-date with the latest security patches to address known vulnerabilities. - Use automated patch management tools to streamline the update process.

Disable Unnecessary Features or Services:

- Turn off unused functionality or components that could introduce vulnerabilities, such as debugging interfaces or deprecated APIs.

Test Configuration Changes:

- Perform configuration changes in a staging environment before applying them in production. - Conduct regular audits to ensure that settings remain aligned with security policies.

*Tools for Implementation*

Configuration Management Tools:

- Ansible: Automates configuration changes across multiple applications and environments. - Chef: Ensures consistent application settings through code-based configuration management. - Puppet: Automates software configurations and audits changes for compliance.

Security Benchmarking Tools:

- CIS-CAT: Provides benchmarks and audits for secure software configurations. - Aqua Security Trivy: Scans containerized applications for configuration issues.

Vulnerability Management Solutions:

- Nessus: Identifies misconfigurations and suggests corrective actions.

Logging and Monitoring Tools:

- Splunk: Aggregates and analyzes application logs to detect suspicious activity.

MitigationEnterprise

M1042: Disable or Remove Feature or Program

Disable or remove unnecessary and potentially vulnerable software, features, or services to reduce the attack surface and prevent abuse by adversaries. This involves identifying software or features that are no longer needed or that could be exploited and ensuring they are either removed or properly disabled. This mitigation can be implemented through the following measures:

Remove Legacy Software:

- Use Case: Disable or remove older versions of software that no longer receive updates or security patches (e.g., legacy Java, Adobe Flash). - Implementation: A company removes Flash Player from all employee systems after it has reached its end-of-life date.

Disable Unused Features:

- Use Case: Turn off unnecessary operating system features like SMBv1, Telnet, or RDP if they are not required. - Implementation: Disable SMBv1 in a Windows environment to mitigate vulnerabilities like EternalBlue.

Control Applications Installed by Users:

- Use Case: Prevent users from installing unauthorized software via group policies or other management tools. - Implementation: Block user installations of unauthorized file-sharing applications (e.g., BitTorrent clients) in an enterprise environment.

Remove Unnecessary Services:

- Use Case: Identify and disable unnecessary default services running on endpoints, servers, or network devices. - Implementation: Disable unused administrative shares (e.g., C$, ADMIN$) on workstations.

Restrict Add-ons and Plugins:

- Use Case: Remove or disable browser plugins and add-ons that are not needed for business purposes. - Implementation: Disable Java and ActiveX plugins in web browsers to prevent drive-by attacks.

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.4
Created
Modified
Raw hash
24a4a7e8efdb6ab9...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.4Current bundle24a4a7e8efdb…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    BleepingComputer DDE Disabled in Word Dec 2017

    Cimpanu, C. (2017, December 15). Microsoft Disables DDE Feature in Word to Prevent Further Malware Attacks. Retrieved December 19, 2017.

    Open source URL
  2. [2]
    Microsoft ADV170021 Dec 2017

    Microsoft. (2017, December 12). ADV170021 - Microsoft Office Defense in Depth Update. Retrieved February 3, 2018.

    Open source URL
  3. [3]
    Microsoft DDE Advisory Nov 2017

    Microsoft. (2017, November 8). Microsoft Security Advisory 4053440 - Securely opening Microsoft Office documents that contain Dynamic Data Exchange (DDE) fields. Retrieved November 21, 2017.

    Open source URL
  4. [4]
    SensePost PS DDE May 2016

    El-Sherei, S. (2016, May 20). PowerShell, C-Sharp and DDE The Power Within. Retrieved November 22, 2017.

    Open source URL
  5. [5]
    Kettle CSV DDE Aug 2014

    Kettle, J. (2014, August 29). Comma Separated Vulnerabilities. Retrieved November 22, 2017.

    Open source URL
  6. [6]
    Enigma Reviving DDE Jan 2018

    Nelson, M. (2018, January 29). Reviving DDE: Using OneNote and Excel for Code Execution. Retrieved February 3, 2018.

    Open source URL
  7. [7]
    SensePost MacroLess DDE Oct 2017

    Stalmans, E., El-Sherei, S. (2017, October 9). Macro-less Code Exec in MSWord. Retrieved November 21, 2017.

    Open source URL
  8. [8]
    OWASP CSV Injection

    Albinowax Timo Goosen. (n.d.). CSV Injection. Retrieved February 7, 2022.

    Open source URL
  9. [9]
    CSV Excel Macro Injection

    Ishaq Mohammed . (2021, January 10). Everything about CSV Injection and CSV Excel Macro Injection. Retrieved February 7, 2022.

    Open source URL
  10. [10]
    Fireeye Hunting COM June 2019

    Hamilton, C. (2019, June 4). Hunting COM Objects. Retrieved June 10, 2019.

    Open source URL
  11. [11]
    Eset Ramsay May 2020

    Sanmillan, I.. (2020, May 13). Ramsay: A cyber‑espionage toolkit tailored for air‑gapped networks. Retrieved May 27, 2020.

    Open source URL
  12. [12]
    McAfee Sharpshooter December 2018

    Sherstobitoff, R., Malhotra, A., et. al.. (2018, December 18). Operation Sharpshooter Campaign Targets Global Defense, Critical Infrastructure. Retrieved May 14, 2020.

    Open source URL
  13. [13]
    FireEye HAWKBALL Jun 2019

    Patil, S. and Williams, M.. (2019, June 5). Government Sector in Central Asia Targeted With New HAWKBALL Backdoor Delivered via Microsoft Office Vulnerabilities. Retrieved June 20, 2019.

    Open source URL
  14. [14]
    Microsoft ASR Nov 2017

    Brower, N. & D'Souza-Wiltshire, I. (2017, November 9). Enable Attack surface reduction. Retrieved February 3, 2018.

    Open source URL
  15. [15]
    Talos Cobalt Group July 2018

    Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018.

    Open source URL
  16. [16]
    CyberScoop FIN7 Oct 2017

    Waterman, S. (2017, October 16). Fin7 weaponization of DDE is just their latest slick move, say researchers. Retrieved November 21, 2017.

    Open source URL
  17. [17]
    Securelist MuddyWater Oct 2018

    Kaspersky Lab's Global Research & Analysis Team. (2018, October 10). MuddyWater expands operations. Retrieved November 2, 2018.

    Open source URL
  18. [18]
    Rewterz Sidewinder APT April 2020

    Rewterz. (2020, April 20). Sidewinder APT Group Campaign Analysis. Retrieved January 29, 2021.

    Open source URL
  19. [19]
    Rewterz Sidewinder COVID-19 June 2020

    Rewterz. (2020, June 22). Analysis on Sidewinder APT Group – COVID-19. Retrieved January 29, 2021.

    Open source URL
  20. [20]
    ESET RTM Feb 2017

    Faou, M. and Boutin, J. (2017, February). Read The Manual: A Guide to the RTM Banking Trojan. Retrieved March 9, 2017.

    Open source URL
  21. [21]
    McAfee APT28 DDE1 Nov 2017

    Sherstobitoff, R., Rea, M. (2017, November 7). Threat Group APT28 Slips Office Malware into Doc Citing NYC Terror Attack. Retrieved November 21, 2017.

    Open source URL
  22. [22]
    McAfee APT28 DDE2 Nov 2017

    Paganini, P. (2017, November 9). Russia-Linked APT28 group observed using DDE attack to deliver malware. Retrieved November 21, 2017.

  23. [23]
    Palo Alto Sofacy 06-2018

    Lee, B., Falcone, R. (2018, June 06). Sofacy Group’s Parallel Attacks. Retrieved June 18, 2018.

    Open source URL
  24. [24]
    SentinelOne Valak June 2020

    Reaves, J. and Platt, J. (2020, June). Valak Malware and the Connection to Gozi Loader ConfCrew. Retrieved August 31, 2020.

    Open source URL
  25. [25]
    Talos PoetRAT April 2020

    Mercer, W, et al. (2020, April 16). PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectors. Retrieved April 27, 2020.

    Open source URL
  26. [26]
    Securelist ScarCruft Jun 2016

    Raiu, C., and Ivanov, A. (2016, June 17). Operation Daybreak. Retrieved February 15, 2018.

    Open source URL
  27. [27]
    FireEye MuddyWater Mar 2018

    Singh, S. et al.. (2018, March 13). Iranian Threat Group Updates Tactics, Techniques and Procedures in Spear Phishing Campaign. Retrieved April 11, 2018.

    Open source URL
  28. [28]
    Microsoft Protected View

    Microsoft. (n.d.). What is Protected View?. Retrieved November 22, 2017.

    Open source URL
  29. [29]
    GitHub Disable DDEAUTO Oct 2017

    Dormann, W. (2017, October 20). Disable DDEAUTO for Outlook, Word, OneNote, and Excel versions 2010, 2013, 2016. Retrieved February 3, 2018.

    Open source URL
  30. [30]
    Symantec Gallmaker Oct 2018

    Symantec Security Response. (2018, October 10). Gallmaker: New Attack Group Eschews Malware to Live off the Land. Retrieved November 27, 2018.

    Open source URL
  31. [31]
    Accenture MUDCARP March 2019

    Accenture iDefense Unit. (2019, March 5). Mudcarp's Focus on Submarine Technologies. Retrieved August 24, 2021.

    Open source URL
  32. [32]
    Cisco Talos Bitter Bangladesh May 2022

    Raghuprasad, C . (2022, May 11). Bitter APT adds Bangladesh to their targets. Retrieved June 1, 2022.

    Open source URL
  33. [33]
    PWC KeyBoys Feb 2017

    Parys, B. (2017, February 11). The KeyBoys are back in town. Retrieved June 13, 2019.

    Open source URL
  34. [34]
    Talos GravityRAT

    Mercer, W., Rascagneres, P. (2018, April 26). GravityRAT - The Two-Year Evolution Of An APT Targeting India. Retrieved May 16, 2018.

    Open source URL
  35. [35]
    Proofpoint TA505 June 2018

    Proofpoint Staff. (2018, June 8). TA505 shifts with the times. Retrieved May 28, 2019.

    Open source URL
  36. [36]
    TrendMicro Patchwork Dec 2017

    Lunghi, D., et al. (2017, December). Untangling the Patchwork Cyberespionage Group. Retrieved July 10, 2018.

    Open source URL
  37. [37]
    BleepingComputer DDE Disabled in Word Dec 2017

    Cimpanu, C. (2017, December 15). Microsoft Disables DDE Feature in Word to Prevent Further Malware Attacks. Retrieved December 19, 2017.

    Open source URL
  38. [38]
    BleepingComputer DDE Disabled in Word Dec 2017

    Cimpanu, C. (2017, December 15). Microsoft Disables DDE Feature in Word to Prevent Further Malware Attacks. Retrieved December 19, 2017.

    Open source URL
  39. [39]
    CSV Excel Macro Injection

    Ishaq Mohammed . (2021, January 10). Everything about CSV Injection and CSV Excel Macro Injection. Retrieved February 7, 2022.

    Open source URL
  40. [40]
    CSV Excel Macro Injection

    Ishaq Mohammed . (2021, January 10). Everything about CSV Injection and CSV Excel Macro Injection. Retrieved February 7, 2022.

    Open source URL
  41. [41]
    Enigma Reviving DDE Jan 2018

    Nelson, M. (2018, January 29). Reviving DDE: Using OneNote and Excel for Code Execution. Retrieved February 3, 2018.

    Open source URL
  42. [42]
    Enigma Reviving DDE Jan 2018

    Nelson, M. (2018, January 29). Reviving DDE: Using OneNote and Excel for Code Execution. Retrieved February 3, 2018.

    Open source URL
  43. [43]
    Fireeye Hunting COM June 2019

    Hamilton, C. (2019, June 4). Hunting COM Objects. Retrieved June 10, 2019.

    Open source URL
  44. [44]
    Fireeye Hunting COM June 2019

    Hamilton, C. (2019, June 4). Hunting COM Objects. Retrieved June 10, 2019.

    Open source URL
  45. [45]
    Kettle CSV DDE Aug 2014

    Kettle, J. (2014, August 29). Comma Separated Vulnerabilities. Retrieved November 22, 2017.

    Open source URL
  46. [46]
    Kettle CSV DDE Aug 2014

    Kettle, J. (2014, August 29). Comma Separated Vulnerabilities. Retrieved November 22, 2017.

    Open source URL
  47. [47]
    Microsoft ADV170021 Dec 2017

    Microsoft. (2017, December 12). ADV170021 - Microsoft Office Defense in Depth Update. Retrieved February 3, 2018.

    Open source URL
  48. [48]
    Microsoft ADV170021 Dec 2017

    Microsoft. (2017, December 12). ADV170021 - Microsoft Office Defense in Depth Update. Retrieved February 3, 2018.

    Open source URL
  49. [49]
    Microsoft DDE Advisory Nov 2017

    Microsoft. (2017, November 8). Microsoft Security Advisory 4053440 - Securely opening Microsoft Office documents that contain Dynamic Data Exchange (DDE) fields. Retrieved November 21, 2017.

    Open source URL
  50. [50]
    Microsoft DDE Advisory Nov 2017

    Microsoft. (2017, November 8). Microsoft Security Advisory 4053440 - Securely opening Microsoft Office documents that contain Dynamic Data Exchange (DDE) fields. Retrieved November 21, 2017.

    Open source URL
  51. [51]
    NVisio Labs DDE Detection Oct 2017

    NVISO Labs. (2017, October 11). Detecting DDE in MS Office documents. Retrieved November 21, 2017.

    Open source URL
  52. [52]
    NVisio Labs DDE Detection Oct 2017

    NVISO Labs. (2017, October 11). Detecting DDE in MS Office documents. Retrieved November 21, 2017.

    Open source URL
  53. [53]
    NVisio Labs DDE Detection Oct 2017

    NVISO Labs. (2017, October 11). Detecting DDE in MS Office documents. Retrieved November 21, 2017.

    Open source URL
  54. [54]
    OWASP CSV Injection

    Albinowax Timo Goosen. (n.d.). CSV Injection. Retrieved February 7, 2022.

    Open source URL
  55. [55]
    OWASP CSV Injection

    Albinowax Timo Goosen. (n.d.). CSV Injection. Retrieved February 7, 2022.

    Open source URL
  56. [56]
    SensePost MacroLess DDE Oct 2017

    Stalmans, E., El-Sherei, S. (2017, October 9). Macro-less Code Exec in MSWord. Retrieved November 21, 2017.

    Open source URL
  57. [57]
    SensePost MacroLess DDE Oct 2017

    Stalmans, E., El-Sherei, S. (2017, October 9). Macro-less Code Exec in MSWord. Retrieved November 21, 2017.

    Open source URL
  58. [58]
    SensePost PS DDE May 2016

    El-Sherei, S. (2016, May 20). PowerShell, C-Sharp and DDE The Power Within. Retrieved November 22, 2017.

    Open source URL
  59. [59]
    SensePost PS DDE May 2016

    El-Sherei, S. (2016, May 20). PowerShell, C-Sharp and DDE The Power Within. Retrieved November 22, 2017.

    Open source URL
  60. [60]
    mitre-attackT1559.002
    Open source URL
  61. [61]
    mitre-attackT1559.002
    Open source URL
  62. [62]
    mitre-attackT1559.002
    Open source URL
  63. [63]
    Eset Ramsay May 2020

    Sanmillan, I.. (2020, May 13). Ramsay: A cyber‑espionage toolkit tailored for air‑gapped networks. Retrieved May 27, 2020.

    Open source URL
  64. [64]
    McAfee Sharpshooter December 2018

    Sherstobitoff, R., Malhotra, A., et. al.. (2018, December 18). Operation Sharpshooter Campaign Targets Global Defense, Critical Infrastructure. Retrieved May 14, 2020.

    Open source URL
  65. [65]
    FireEye HAWKBALL Jun 2019

    Patil, S. and Williams, M.. (2019, June 5). Government Sector in Central Asia Targeted With New HAWKBALL Backdoor Delivered via Microsoft Office Vulnerabilities. Retrieved June 20, 2019.

    Open source URL
  66. [66]
    Enigma Reviving DDE Jan 2018

    Nelson, M. (2018, January 29). Reviving DDE: Using OneNote and Excel for Code Execution. Retrieved February 3, 2018.

    Open source URL
  67. [67]
    Enigma Reviving DDE Jan 2018

    Nelson, M. (2018, January 29). Reviving DDE: Using OneNote and Excel for Code Execution. Retrieved February 3, 2018.

    Open source URL
  68. [68]
    Microsoft ASR Nov 2017

    Brower, N. & D'Souza-Wiltshire, I. (2017, November 9). Enable Attack surface reduction. Retrieved February 3, 2018.

    Open source URL
  69. [69]
    Talos Cobalt Group July 2018

    Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018.

    Open source URL
  70. [70]
    CyberScoop FIN7 Oct 2017

    Waterman, S. (2017, October 16). Fin7 weaponization of DDE is just their latest slick move, say researchers. Retrieved November 21, 2017.

    Open source URL
  71. [71]
    Securelist MuddyWater Oct 2018

    Kaspersky Lab's Global Research & Analysis Team. (2018, October 10). MuddyWater expands operations. Retrieved November 2, 2018.

    Open source URL
  72. [72]
    Rewterz Sidewinder APT April 2020

    Rewterz. (2020, April 20). Sidewinder APT Group Campaign Analysis. Retrieved January 29, 2021.

    Open source URL
  73. [73]
    Rewterz Sidewinder COVID-19 June 2020

    Rewterz. (2020, June 22). Analysis on Sidewinder APT Group – COVID-19. Retrieved January 29, 2021.

    Open source URL
  74. [74]
    ESET RTM Feb 2017

    Faou, M. and Boutin, J. (2017, February). Read The Manual: A Guide to the RTM Banking Trojan. Retrieved March 9, 2017.

    Open source URL
  75. [75]
    McAfee APT28 DDE1 Nov 2017

    Sherstobitoff, R., Rea, M. (2017, November 7). Threat Group APT28 Slips Office Malware into Doc Citing NYC Terror Attack. Retrieved November 21, 2017.

    Open source URL
  76. [76]
    McAfee APT28 DDE2 Nov 2017

    Paganini, P. (2017, November 9). Russia-Linked APT28 group observed using DDE attack to deliver malware. Retrieved November 21, 2017.

  77. [77]
    Palo Alto Sofacy 06-2018

    Lee, B., Falcone, R. (2018, June 06). Sofacy Group’s Parallel Attacks. Retrieved June 18, 2018.

    Open source URL
  78. [78]
    SentinelOne Valak June 2020

    Reaves, J. and Platt, J. (2020, June). Valak Malware and the Connection to Gozi Loader ConfCrew. Retrieved August 31, 2020.

    Open source URL
  79. [79]
    Talos PoetRAT April 2020

    Mercer, W, et al. (2020, April 16). PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectors. Retrieved April 27, 2020.

    Open source URL
  80. [80]
    Securelist ScarCruft Jun 2016

    Raiu, C., and Ivanov, A. (2016, June 17). Operation Daybreak. Retrieved February 15, 2018.

    Open source URL
  81. [81]
    FireEye MuddyWater Mar 2018

    Singh, S. et al.. (2018, March 13). Iranian Threat Group Updates Tactics, Techniques and Procedures in Spear Phishing Campaign. Retrieved April 11, 2018.

    Open source URL
  82. [82]
    Microsoft Protected View

    Microsoft. (n.d.). What is Protected View?. Retrieved November 22, 2017.

    Open source URL
  83. [83]
    Enigma Reviving DDE Jan 2018

    Nelson, M. (2018, January 29). Reviving DDE: Using OneNote and Excel for Code Execution. Retrieved February 3, 2018.

    Open source URL
  84. [84]
    Enigma Reviving DDE Jan 2018

    Nelson, M. (2018, January 29). Reviving DDE: Using OneNote and Excel for Code Execution. Retrieved February 3, 2018.

    Open source URL
  85. [85]
    GitHub Disable DDEAUTO Oct 2017

    Dormann, W. (2017, October 20). Disable DDEAUTO for Outlook, Word, OneNote, and Excel versions 2010, 2013, 2016. Retrieved February 3, 2018.

    Open source URL
  86. [86]
    Symantec Gallmaker Oct 2018

    Symantec Security Response. (2018, October 10). Gallmaker: New Attack Group Eschews Malware to Live off the Land. Retrieved November 27, 2018.

    Open source URL
  87. [87]
    Accenture MUDCARP March 2019

    Accenture iDefense Unit. (2019, March 5). Mudcarp's Focus on Submarine Technologies. Retrieved August 24, 2021.

    Open source URL
  88. [88]
    Cisco Talos Bitter Bangladesh May 2022

    Raghuprasad, C . (2022, May 11). Bitter APT adds Bangladesh to their targets. Retrieved June 1, 2022.

    Open source URL
  89. [89]
    PWC KeyBoys Feb 2017

    Parys, B. (2017, February 11). The KeyBoys are back in town. Retrieved June 13, 2019.

    Open source URL
  90. [90]
    Talos GravityRAT

    Mercer, W., Rascagneres, P. (2018, April 26). GravityRAT - The Two-Year Evolution Of An APT Targeting India. Retrieved May 16, 2018.

    Open source URL
  91. [91]
    BleepingComputer DDE Disabled in Word Dec 2017

    Cimpanu, C. (2017, December 15). Microsoft Disables DDE Feature in Word to Prevent Further Malware Attacks. Retrieved December 19, 2017.

    Open source URL
  92. [92]
    GitHub Disable DDEAUTO Oct 2017

    Dormann, W. (2017, October 20). Disable DDEAUTO for Outlook, Word, OneNote, and Excel versions 2010, 2013, 2016. Retrieved February 3, 2018.

    Open source URL
  93. [93]
    Microsoft ADV170021 Dec 2017

    Microsoft. (2017, December 12). ADV170021 - Microsoft Office Defense in Depth Update. Retrieved February 3, 2018.

    Open source URL
  94. [94]
    Microsoft DDE Advisory Nov 2017

    Microsoft. (2017, November 8). Microsoft Security Advisory 4053440 - Securely opening Microsoft Office documents that contain Dynamic Data Exchange (DDE) fields. Retrieved November 21, 2017.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use