{"id":"T1574.007","name":"Path Interception by PATH Environment Variable","url":"https://attack.mitre.org/techniques/T1574/007","tactics":["stealth","execution"],"platforms":["Linux","macOS","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0004","stix_id":"x-mitre-detection-strategy--4b2bc278-fc80-4ff8-87a3-a6843a9e683a","name":"Detection Strategy for Hijack Execution Flow using Path Interception by PATH Environment Variable.","url":"https://attack.mitre.org/detectionstrategies/DET0004","analytics":[{"id":"AN0009","stix_id":"x-mitre-analytic--bbd003ec-4208-48bb-9ad5-b9dd627fdd14","name":"Analytic 0009","description":"Abnormal modification of the PATH environment variable or registry keys controlling system paths, combined with execution of binaries named after legitimate system tools from user-writable directories. Defender correlates registry modifications, file creation of suspicious binaries, and process execution paths inconsistent with baseline system directories.","url":"https://attack.mitre.org/detectionstrategies/DET0004#AN0009","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Security","channel":"EventCode=4657","data_component":"DC0063","data_component_name":"Windows Registry Key Modification","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Sysmon","channel":"EventCode=11","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"MonitoredRegistryKeys","description":"PATH environment keys under HKCU and HKLM to monitor for changes."},{"field":"SuspiciousBinaryList","description":"List of high-value system binaries commonly hijacked (e.g., net.exe, python.exe, powershell.exe)."},{"field":"TimeWindow","description":"Correlation window between PATH modification and execution of a hijacked binary."}],"live":true,"detection_strategies":["DET0004"],"techniques":["T1574.007"]},{"id":"AN0010","stix_id":"x-mitre-analytic--00b5d9a8-a794-4d7c-90df-71c4021e0a46","name":"Analytic 0010","description":"User modification of the $PATH environment variable in shell configuration files or direct runtime PATH changes, followed by execution of binaries from user-controlled directories. Defender observes file edits to ~/.bashrc, ~/.profile, or /etc/paths.d and process execution resolving to unexpected binary locations.","url":"https://attack.mitre.org/detectionstrategies/DET0004#AN0010","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"open/write calls modifying ~/.bashrc, ~/.profile, or /etc/paths.d","data_component":"DC0061","data_component_name":"File Modification","log_source_slug":"auditd-syscall"},{"name":"linux:osquery","channel":"Execution of binary resolved from $PATH not located in /usr/bin or /bin","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"linux-osquery"}],"mutable_elements":[{"field":"MonitoredShellConfigs","description":"Set of shell startup files where PATH changes should be flagged."},{"field":"AllowedUserBins","description":"Directories (e.g., /usr/local/bin) considered safe to avoid FP."}],"live":true,"detection_strategies":["DET0004"],"techniques":["T1574.007"]},{"id":"AN0011","stix_id":"x-mitre-analytic--b2261c7f-664b-400c-b8ba-8b5bc3bac75a","name":"Analytic 0011","description":"Modification of PATH or HOME environment variables through shell config files, launchctl, or /etc/paths.d entries, combined with process execution from attacker-controlled directories. Defender correlates file changes in /etc/paths.d with process execution resolving to malicious binaries.","url":"https://attack.mitre.org/detectionstrategies/DET0004#AN0011","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"File modification in /etc/paths.d or user shell rc files","data_component":"DC0061","data_component_name":"File Modification","log_source_slug":"macos-unifiedlog"},{"name":"macos:unifiedlog","channel":"Process execution path inconsistent with baseline PATH directories","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-unifiedlog"}],"mutable_elements":[{"field":"WatchedPathsDirs","description":"Monitor /etc/paths.d and $HOME for unauthorized entries."},{"field":"TrustedExecutables","description":"Baseline applications expected in user PATH directories."}],"live":true,"detection_strategies":["DET0004"],"techniques":["T1574.007"]}],"live":true,"version":"1.0","techniques":["T1574.007"]}],"sigma_rules":[{"id":"0cbe38c0-270c-41d9-ab79-6e5a9a669290","title":"Trusted Path Bypass via Windows Directory Spoofing","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-06-17","modified":null,"description":"Detects DLLs loading from a spoofed Windows directory path with an extra space (e.g \"C:\\Windows \\System32\") which can bypass Windows trusted path verification.\nThis technique tricks Windows into treating the path as trusted, allowing malicious DLLs to load with high integrity privileges bypassing UAC.\n","references":["https://x.com/Wietze/status/1933495426952421843"],"logsource":{"product":"windows","category":"image_load"},"tags":["attack.persistence","attack.privilege-escalation","attack.execution","attack.stealth","attack.t1574.007","attack.t1548.002"],"path":"rules/windows/image_load/image_load_win_trusted_path_bypass.yml","techniques":["T1574.007","T1548.002"],"cves":[]},{"id":"c2c76b77-32be-4d1f-82c9-7e544bdfe0eb","title":"Potential Suspicious Activity Using SeCEdit","author":"Janantha Marasinghe","status":"test","level":"medium","date":"2022-11-18","modified":"2022-12-30","description":"Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy","references":["https://blueteamops.medium.com/secedit-and-i-know-it-595056dee53d","https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/secedit"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.collection","attack.discovery","attack.persistence","attack.credential-access","attack.privilege-escalation","attack.execution","attack.stealth","attack.defense-impairment","attack.t1685.001","attack.t1547.001","attack.t1505.005","attack.t1556.002","attack.t1685","attack.t1574.007","attack.t1564.002","attack.t1546.008","attack.t1546.007","attack.t1547.014","attack.t1547.010","attack.t1547.002","attack.t1557","attack.t1082"],"path":"rules/windows/process_creation/proc_creation_win_secedit_execution.yml","techniques":["T1685.001","T1547.001","T1505.005","T1556.002","T1685","T1574.007","T1564.002","T1546.008","T1546.007","T1547.014","T1547.010","T1547.002","T1557","T1082"],"cves":[]}],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}