Techniques › T1574
T1574 Hijack Execution Flow
stealth · execution — Linux, macOS, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
3
analytics
8
Sigma rules tagged attack.t1574
16
KEV CVEs mapped here
<p>Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs. Hijacking execution flow can be for the purposes of persistence, since this hijacked execution may reoccur over time. Adversaries may also use these mechanisms to elevate privileges or evade defenses, such as application control or other restrictions on execution.</p><p>There are many ways an adversary may hijack the flow of execution, including by manipulating how the operating system locates programs to be executed. How the operating system locates libraries to be used by a program can also be intercepted. Locations where the operating system looks for programs/resources, such as file directories and in the case of Windows the Registry, could also be poisoned to include malicious payloads.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
| CVE | Vendor / product | Mapping type | State | Added |
|---|---|---|---|---|
| CVE-2025-27363 | FreeType FreeType | primary impact | Mapped | 2025-05-06 |
| CVE-2024-21762 | Fortinet FortiOS | exploitation technique primary impact | Mapped | 2024-02-09 |
| CVE-2023-6549 | Citrix NetScaler ADC and NetScaler Gateway | exploitation technique | Mapped | 2024-01-17 |
| CVE-2023-7024 | Google Chromium WebRTC | primary impact | Mapped | 2024-01-02 |
| CVE-2023-4966 | Citrix NetScaler ADC and NetScaler Gateway | exploitation technique | Mapped | 2023-10-18 |
| CVE-2023-5217 | Google Chromium libvpx | primary impact | Mapped | 2023-10-02 |
| CVE-2023-3519 | Citrix NetScaler ADC and NetScaler Gateway | exploitation technique | Mapped | 2023-07-19 |
| CVE-2023-27997 | Fortinet FortiOS and FortiProxy SSL-VPN | exploitation technique | Mapped | 2023-06-13 |
| CVE-2017-6742 | Cisco IOS and IOS XE Software | exploitation technique | Mapped | 2023-04-19 |
| CVE-2022-3038 | Google Chromium Network Service | primary impact | Mapped | 2023-03-30 |
| CVE-2022-41328 | Fortinet FortiOS | exploitation technique | Mapped | 2023-03-14 |
| CVE-2022-42475 | Fortinet FortiOS | primary impact | Mapped | 2022-12-13 |
| CVE-2022-41073 | Microsoft Windows | secondary impact | Mapped | 2022-11-08 |
| CVE-2016-1010 | Adobe Flash Player and AIR | exploitation technique | Mapped | 2022-05-25 |
| CVE-2022-1040 | Sophos Firewall | secondary impact | Mapped | 2022-03-31 |
| CVE-2020-5735 | Amcrest Cameras and Network Video Recorder (NVR) | primary impact | Mapped | 2021-11-03 |
Detection strategy · ATT&CK Enterprise v19.2
- DET0218 Detection Strategy for Hijack Execution Flow across OS platforms. v1.0
AN0609 WindowsUnusual modifications to service binary paths, registry keys, or DLL load paths resulting in alternate execution flow. Defender observes registry key modifications, suspicious file writes into system directories, and processes loading libraries from abnormal paths.Tunable:
ServiceBaselineAllowedDllPathsTimeWindowAN0610 LinuxAdversary manipulation of shared library paths, environment variables, or replacement of service binaries. Defender observes suspicious modifications in /etc/ld.so.preload, service config changes, or file writes replacing existing executables.auditd:SYSCALLopen/write syscalls targeting /etc/ld.so.preload or binaries in /usr/bin→ DC0061 File ModificationTunable:MonitoredDirectoriesEnvVarMonitorsAN0611 macOSAbuse of DYLD_INSERT_LIBRARIES or hijacking framework paths for malicious libraries. Defender observes processes invoking abnormal dylibs, modified plist files, or persistence entries pointing to altered binaries.macos:unifiedlogModified application plist or binary replacement in /Applications→ DC0061 File ModificationTunable:AllowedDylibPathsPlistMonitors
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1574
Author: FPT.EagleEye, Thomas Patzke (improvements)
· 2021-06-29 (modified 2022-06-02) · logsource: product=windows category=image_load · 02fb90de-c321-4e63-a6b9-25f4b03dfd14
Detect DLL Load from Spooler Service backup folder. This behavior has been observed during the exploitation of the Print Spooler Vulnerability CVE-2021-1675 and CVE-2021-34527 (PrinterNightmare).
Author: Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro
· 2019-11-15 (modified 2021-11-27) · logsource: product=windows category=process_creation · 1c373b6d-76ce-4553-997d-8c1da9a6b5f5
Detects exploitation attempt of privilege escalation vulnerability via SetupComplete.cmd and PartnerSetupComplete.cmd described in CVE-2019-1378
Author: Florian Roth (Nextron Systems)
· 2019-07-17 (modified 2023-05-24) · logsource: product=windows category=process_creation · 50919691-7302-437f-8e10-1fe088afa145
Detects a "regsvr32" execution where the DLL doesn't contain a common file extension.
Author: Bhabesh Raj
· 2021-07-01 (modified 2023-02-17) · logsource: product=windows category=file_delete · 5b2bbc47-dead-4ef7-8908-0cf73fcbecbf
Detect DLL deletions from Spooler Service driver folder. This might be a potential exploitation attempt of CVE-2021-1675
Author: frack113
· 2022-08-07 (modified 2023-08-17) · logsource: product=windows category=registry_set · 9827ae57-3802-418f-994b-d5ecf5cd974b
Detects the addition of the "Debugger" value to the "DbgManagedDebugger" key in order to achieve persistence. Which will get invoked when an application crashes
Author: Ivan Dyachkov, Yulia Fomina, oscd.community
· 2020-10-07 (modified 2021-11-27) · logsource: product=windows category=process_creation · a2910908-e86f-4687-aeba-76a5f996e652
Detects using register-cimprovider.exe to execute arbitrary dll file.
Author: Tim Rauch (rule), Elastic (idea)
· 2022-10-21 · logsource: product=windows category=file_event · dbbd9f66-2ed3-4ca2-98a4-6ea985dd1a1c
Detects attempts to create a DLL file to a known desktop application dependencies folder such as Slack, Teams or OneDrive and by an unusual process. This may indicate an attempt to load a malicious module via DLL search order hijacking.
Author: Florian Roth (Nextron Systems)
· 2020-07-01 (modified 2023-08-17) · logsource: product=windows category=registry_set · e0813366-0407-449a-9869-a2db1119dc41
Detects a suspicious printer driver installation with an empty Manufacturer value
Sub-techniques
| ID | Name | Sigma rules | KEV CVEs |
|---|---|---|---|
| T1574.001 | DLL | 93 | 0 |
| T1574.004 | Dylib Hijacking | 0 | 0 |
| T1574.005 | Executable Installer File Permissions Weakness | 2 | 0 |
| T1574.006 | Dynamic Linker Hijacking | 2 | 0 |
| T1574.007 | Path Interception by PATH Environment Variable | 2 | 0 |
| T1574.008 | Path Interception by Search Order Hijacking | 2 | 0 |
| T1574.009 | Path Interception by Unquoted Path | 0 | 0 |
| T1574.010 | Services File Permissions Weakness | 0 | 0 |
| T1574.011 | Services Registry Permissions Weakness | 11 | 0 |
| T1574.012 | COR_PROFILER | 2 | 0 |
| T1574.013 | KernelCallbackTable | 0 | 0 |
| T1574.014 | AppDomainManager | 0 | 0 |