Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1559.002_dynamic-data-exchange
Adversaries may use Windows Dynamic Data Exchange (DDE) to execute arbitrary commands.
Passed 19 of 22 test cases with the skill, and 16 of 22 without it.
and 1 more in the full report
3 fixed16 passed either way3 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 3 test cases the skill fixed. Same model, same prompt, with and without the skill.
When performing application vulnerability assessments on CSV formula execution and macro-less Office links, engineers often report this issue under CWE-74 (Improper Neutralization of Special Elements) or CWE-20 (Improper Input Validation). Which CWE ID specifically categorizes Dynamic Data Exchange execution?
| Checked | Without skill | With skill |
|---|---|---|
| Identifies CWE-94 as the specific CWE mapping. | Missed | Passed |
The instructions your model reads when the skill loads.
Sub-technique of: T1559
Adversaries may use Windows Dynamic Data Exchange (DDE) to execute arbitrary commands. DDE is a client-server protocol for one-time and/or continuous inter-process communication (IPC) between applications. Once a link is established, applications can autonomously exchange transactions consisting of strings, warm data links (notifications when a data item changes), hot data links (duplications of changes to a data item), and requests for command execution.
Object Linking and Embedding (OLE), or the ability to link data between documents, was originally implemented through DDE. Despite being superseded by Component Object Model, DDE may be enabled in Windows 10 and most of Microsoft Office 2016 via Registry keys.
Microsoft Office documents can be poisoned with DDE commands, directly or through embedded files, and used to deliver execution via Phishing campaigns or hosted Web content, avoiding the use of Visual Basic for Applications (VBA) macros. Similarly, adversaries may infect payloads to execute applications and/or commands on a victim device by way of embedding DDE formulas within a CSV file intended to be opened through a Windows spreadsheet program.
DDE could also be leveraged by an adversary operating on a compromised machine who does not have direct access to a Command and Scripting Interpreter. DDE execution can be invoked remotely via Remote Services such as Distributed Component Object Model (DCOM).
Platforms: Windows
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
Executes commands via DDE using Microsfot Word
Supported Platforms: windows
test cases passed, vs 16 / 22 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.