MITRE ATT&CKtechnique

T1574 Hijack Execution Flow

Published 2020-03-12 Modified 2026-09-02 Official page ↗
Domain
enterprise
Tactics
Stealth, Execution
Platforms
Linux, macOS, Windows
Version
2.1
Created
2020-03-12

Description

Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs. Hijacking execution flow can be for the purposes of persistence, since this hijacked execution may reoccur over time. Adversaries may also use these mechanisms to elevate privileges or evade defenses, such as application control or other restrictions on execution. There are many ways an adversary may hijack the flow of execution, including by manipulating how the operating system locates programs to be executed. How the operating system locates libraries to be used by a program can also be intercepted. Locations where the operating system looks for programs/resources, such as file directories and in the case of Windows the Registry, could also be poisoned to include malicious payloads.

Related

Tactic · MITRE ATT&CK (2)

Referenced by MITRE ATT&CK · mitigates (10)

  • M1038 Execution Prevention mitigation
  • M1040 Behavior Prevention on Endpoint mitigation
  • M1044 Restrict Library Loading mitigation
  • M1047 Audit mitigation
  • M1051 Update Software mitigation
  • M1052 User Account Control mitigation
  • M1018 User Account Management mitigation
  • M1022 Restrict File and Directory Permissions mitigation
  • M1024 Restrict Registry Permissions mitigation
  • M1013 Application Developer Guidance mitigation

Referenced by MITRE ATT&CK · subtechnique of (12)

  • T1574.014 AppDomainManager sub-technique
  • T1574.013 KernelCallbackTable sub-technique
  • T1574.012 COR_PROFILER sub-technique
  • T1574.004 Dylib Hijacking sub-technique
  • T1574.001 DLL sub-technique
  • T1574.005 Executable Installer File Permissions Weakness sub-technique
  • T1574.006 Dynamic Linker Hijacking sub-technique
  • T1574.007 Path Interception by PATH Environment Variable sub-technique
  • T1574.008 Path Interception by Search Order Hijacking sub-technique
  • T1574.009 Path Interception by Unquoted Path sub-technique
  • T1574.011 Services Registry Permissions Weakness sub-technique
  • T1574.010 Services File Permissions Weakness sub-technique

Referenced by MITRE ATT&CK · uses (11)

  • S9024 SPAWNCHIMERA software (malware)
  • S1147 Nightdoor software (malware)
  • C0036 Pikabot Distribution February 2024 campaign
  • S1130 Raspberry Robin software (malware)
  • S1111 DarkGate software (malware)
  • S1105 COATHANGER software (malware)
  • C0017 C0017 campaign
  • S1018 Saint Bot software (malware)
  • S0567 Dtrack software (malware)
  • S0444 ShimRat software (malware)
  • S0354 Denis software (malware)

Referenced by Compliance · mitigates (25)

  • CIS-13.7 Deploy a Host-Based Intrusion Prevention Solution CIS Safeguard v8.1
  • CIS-16.10 Apply Secure Design Principles in Application Architectures CIS Safeguard v8.1
  • CIS-16.11 Leverage Vetted Modules or Services for Application Security Components CIS Safeguard v8.1
  • CIS-16.12 Implement Code-Level Security Checks CIS Safeguard v8.1
  • CIS-6.8 Define and Maintain Role-Based Access Control CIS Safeguard v8.1
  • CIS-7.4 Perform Automated Application Patch Management CIS Safeguard v8.1
  • CIS-7.7 Remediate Detected Vulnerabilities CIS Safeguard v8.1
  • NIST-AC-2 Account Management NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-4 Information Flow Enforcement NIST 800-53 control
  • NIST-AC-5 Separation of Duties NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-CA-7 Continuous Monitoring NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-5 Access Restrictions for Change NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-CM-7 Least Functionality NIST 800-53 control
  • NIST-CM-8 System Component Inventory NIST 800-53 control
  • NIST-IA-2 Identification and Authentication (Organizational Users) NIST 800-53 control
  • NIST-RA-5 Vulnerability Monitoring and Scanning NIST 800-53 control
  • NIST-SI-10 Information Input Validation NIST 800-53 control
  • NIST-SI-2 Flaw Remediation NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control
  • NIST-SI-7 Software, Firmware, and Information Integrity NIST 800-53 control

References