{"id":"T1574","name":"Hijack Execution Flow","url":"https://attack.mitre.org/techniques/T1574","tactics":["stealth","execution"],"platforms":["Linux","macOS","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0218","stix_id":"x-mitre-detection-strategy--07669925-383b-455b-a3e2-3a79e18eed27","name":"Detection Strategy for Hijack Execution Flow across OS platforms.","url":"https://attack.mitre.org/detectionstrategies/DET0218","analytics":[{"id":"AN0609","stix_id":"x-mitre-analytic--248be939-35f5-4c8a-9e21-b6de514da577","name":"Analytic 0609","description":"Unusual modifications to service binary paths, registry keys, or DLL load paths resulting in alternate execution flow. Defender observes registry key modifications, suspicious file writes into system directories, and processes loading libraries from abnormal paths.","url":"https://attack.mitre.org/detectionstrategies/DET0218#AN0609","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=7","data_component":"DC0016","data_component_name":"Module Load","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Security","channel":"EventCode=4657","data_component":"DC0063","data_component_name":"Windows Registry Key Modification","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Sysmon","channel":"EventCode=11","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"ServiceBaseline","description":"Expected registry keys and service paths for comparison."},{"field":"AllowedDllPaths","description":"Directories considered valid for DLL loading."},{"field":"TimeWindow","description":"Correlation interval between registry/file modification and process execution."}],"live":true,"detection_strategies":["DET0218"],"techniques":["T1574"]},{"id":"AN0610","stix_id":"x-mitre-analytic--e21542c4-8df8-4c9e-8b1d-2c9bbe058386","name":"Analytic 0610","description":"Adversary manipulation of shared library paths, environment variables, or replacement of service binaries. Defender observes suspicious modifications in /etc/ld.so.preload, service config changes, or file writes replacing existing executables.","url":"https://attack.mitre.org/detectionstrategies/DET0218#AN0610","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"open/write syscalls targeting /etc/ld.so.preload or binaries in /usr/bin","data_component":"DC0061","data_component_name":"File Modification","log_source_slug":"auditd-syscall"},{"name":"linux:syslog","channel":"Service restart with modified executable path","data_component":"DC0041","data_component_name":"Service Metadata","log_source_slug":"linux-syslog"},{"name":"linux:osquery","channel":"Process execution with LD_PRELOAD or modified library path","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"linux-osquery"}],"mutable_elements":[{"field":"MonitoredDirectories","description":"Directories where binary replacement should trigger alerts."},{"field":"EnvVarMonitors","description":"Environment variables like LD_PRELOAD or PATH to monitor."}],"live":true,"detection_strategies":["DET0218"],"techniques":["T1574"]},{"id":"AN0611","stix_id":"x-mitre-analytic--e8fc16bf-6654-4912-96c9-208e4c5bbaa6","name":"Analytic 0611","description":"Abuse of DYLD_INSERT_LIBRARIES or hijacking framework paths for malicious libraries. Defender observes processes invoking abnormal dylibs, modified plist files, or persistence entries pointing to altered binaries.","url":"https://attack.mitre.org/detectionstrategies/DET0218#AN0611","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"Execution of process with DYLD_INSERT_LIBRARIES set","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-unifiedlog"},{"name":"macos:unifiedlog","channel":"Modified application plist or binary replacement in /Applications","data_component":"DC0061","data_component_name":"File Modification","log_source_slug":"macos-unifiedlog"},{"name":"macos:unifiedlog","channel":"Dylib loaded from abnormal location","data_component":"DC0016","data_component_name":"Module Load","log_source_slug":"macos-unifiedlog"}],"mutable_elements":[{"field":"AllowedDylibPaths","description":"Baseline directories for dylib loading."},{"field":"PlistMonitors","description":"Specific plist files used for persistence monitoring."}],"live":true,"detection_strategies":["DET0218"],"techniques":["T1574"]}],"live":true,"version":"1.0","techniques":["T1574"]}],"sigma_rules":[{"id":"02fb90de-c321-4e63-a6b9-25f4b03dfd14","title":"Windows Spooler Service Suspicious Binary Load","author":"FPT.EagleEye, Thomas Patzke (improvements)","status":"test","level":"informational","date":"2021-06-29","modified":"2022-06-02","description":"Detect DLL Load from Spooler Service backup folder. This behavior has been observed during the exploitation of the Print Spooler Vulnerability CVE-2021-1675 and CVE-2021-34527 (PrinterNightmare).\n","references":["https://web.archive.org/web/20210629055600/https://github.com/hhlxf/PrintNightmare/","https://github.com/ly4k/SpoolFool"],"logsource":{"product":"windows","category":"image_load"},"tags":["attack.persistence","attack.privilege-escalation","attack.execution","attack.stealth","attack.t1574","cve.2021-1675","cve.2021-34527","detection.emerging-threats"],"path":"rules-emerging-threats/2021/Exploits/CVE-2021-1675/image_load_exploit_cve_2021_1675_spoolsv_dll_load.yml","techniques":["T1574"],"cves":["CVE-2021-1675","CVE-2021-34527"]},{"id":"1c373b6d-76ce-4553-997d-8c1da9a6b5f5","title":"Exploiting SetupComplete.cmd CVE-2019-1378","author":"Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro","status":"test","level":"high","date":"2019-11-15","modified":"2021-11-27","description":"Detects exploitation attempt of privilege escalation vulnerability via SetupComplete.cmd and PartnerSetupComplete.cmd described in CVE-2019-1378","references":["https://web.archive.org/web/20200530031708/https://www.embercybersecurity.com/blog/cve-2019-1378-exploiting-an-access-control-privilege-escalation-vulnerability-in-windows-10-update-assistant-wua"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.persistence","attack.privilege-escalation","attack.stealth","attack.t1068","attack.execution","attack.t1059.003","attack.t1574","cve.2019-1378","detection.emerging-threats"],"path":"rules-emerging-threats/2019/Exploits/CVE-2019-1378/proc_creation_win_exploit_cve_2019_1378.yml","techniques":["T1068","T1059.003","T1574"],"cves":["CVE-2019-1378"]},{"id":"50919691-7302-437f-8e10-1fe088afa145","title":"Regsvr32 DLL Execution With Uncommon Extension","author":"Florian Roth (Nextron Systems)","status":"test","level":"medium","date":"2019-07-17","modified":"2023-05-24","description":"Detects a \"regsvr32\" execution where the DLL doesn't contain a common file extension.","references":["https://app.any.run/tasks/34221348-072d-4b70-93f3-aa71f6ebecad/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.persistence","attack.stealth","attack.t1574","attack.execution"],"path":"rules/windows/process_creation/proc_creation_win_regsvr32_uncommon_extension.yml","techniques":["T1574"],"cves":[]},{"id":"5b2bbc47-dead-4ef7-8908-0cf73fcbecbf","title":"Potential PrintNightmare Exploitation Attempt","author":"Bhabesh Raj","status":"test","level":"high","date":"2021-07-01","modified":"2023-02-17","description":"Detect DLL deletions from Spooler Service driver folder. This might be a potential exploitation attempt of CVE-2021-1675","references":["https://web.archive.org/web/20210629055600/https://github.com/hhlxf/PrintNightmare/","https://github.com/cube0x0/CVE-2021-1675"],"logsource":{"product":"windows","category":"file_delete"},"tags":["attack.persistence","attack.privilege-escalation","attack.execution","attack.stealth","attack.t1574","cve.2021-1675","detection.emerging-threats"],"path":"rules-emerging-threats/2021/Exploits/CVE-2021-1675/file_delete_win_exploit_cve_2021_1675_print_nightmare.yml","techniques":["T1574"],"cves":["CVE-2021-1675"]},{"id":"9827ae57-3802-418f-994b-d5ecf5cd974b","title":"Potential Registry Persistence Attempt Via DbgManagedDebugger","author":"frack113","status":"test","level":"medium","date":"2022-08-07","modified":"2023-08-17","description":"Detects the addition of the \"Debugger\" value to the \"DbgManagedDebugger\" key in order to achieve persistence. Which will get invoked when an application crashes","references":["https://www.hexacorn.com/blog/2013/09/19/beyond-good-ol-run-key-part-4/","https://github.com/last-byte/PersistenceSniper"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.privilege-escalation","attack.persistence","attack.execution","attack.stealth","attack.t1574"],"path":"rules/windows/registry/registry_set/registry_set_dbgmanageddebugger_persistence.yml","techniques":["T1574"],"cves":[]},{"id":"a2910908-e86f-4687-aeba-76a5f996e652","title":"DLL Execution Via Register-cimprovider.exe","author":"Ivan Dyachkov, Yulia Fomina, oscd.community","status":"test","level":"medium","date":"2020-10-07","modified":"2021-11-27","description":"Detects using register-cimprovider.exe to execute arbitrary dll file.","references":["https://twitter.com/PhilipTsukerman/status/992021361106268161","https://lolbas-project.github.io/lolbas/Binaries/Register-cimprovider/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.persistence","attack.execution","attack.stealth","attack.t1574"],"path":"rules/windows/process_creation/proc_creation_win_registry_cimprovider_dll_load.yml","techniques":["T1574"],"cves":[]},{"id":"dbbd9f66-2ed3-4ca2-98a4-6ea985dd1a1c","title":"Potential Initial Access via DLL Search Order Hijacking","author":"Tim Rauch (rule), Elastic (idea)","status":"test","level":"medium","date":"2022-10-21","modified":null,"description":"Detects attempts to create a DLL file to a known desktop application dependencies folder such as Slack, Teams or OneDrive and by an unusual process. This may indicate an attempt to load a malicious module via DLL search order hijacking.","references":["https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-5d46dd4ac6866b4337ec126be8cee0e115467b3e8703794ba6f6df6432c806bc","https://posts.specterops.io/automating-dll-hijack-discovery-81c4295904b0"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.privilege-escalation","attack.persistence","attack.execution","attack.stealth","attack.t1566","attack.t1566.001","attack.initial-access","attack.t1574","attack.t1574.001"],"path":"rules/windows/file/file_event/file_event_win_initial_access_dll_search_order_hijacking.yml","techniques":["T1566","T1566.001","T1574","T1574.001"],"cves":[]},{"id":"e0813366-0407-449a-9869-a2db1119dc41","title":"Suspicious Printer Driver Empty Manufacturer","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2020-07-01","modified":"2023-08-17","description":"Detects a suspicious printer driver installation with an empty Manufacturer value","references":["https://twitter.com/SBousseaden/status/1410545674773467140"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.persistence","attack.privilege-escalation","attack.execution","attack.stealth","attack.t1574","cve.2021-1675"],"path":"rules/windows/registry/registry_set/registry_set_susp_printer_driver.yml","techniques":["T1574"],"cves":["CVE-2021-1675"]}],"kev_cves":[{"cveID":"CVE-2025-27363","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2024-21762","state":"mapped","mapping_types":["exploitation_technique","primary_impact"]},{"cveID":"CVE-2023-6549","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2023-7024","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2023-4966","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2023-5217","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2023-3519","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2023-27997","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2017-6742","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2022-3038","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2022-41328","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2022-42475","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2022-41073","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2016-1010","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2022-1040","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2020-5735","state":"mapped","mapping_types":["primary_impact"]}],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}