- Tactics
- stealth , Execution
- Platforms
- Linux, macOS, Windows
- Reference
- attack.mitre.org/techniques/T1574
Description
Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs. Hijacking execution flow can be for the purposes of persistence, since this hijacked execution may reoccur over time. Adversaries may also use these mechanisms to elevate privileges or evade defenses, such as application control or other restrictions on execution.
There are many ways an adversary may hijack the flow of execution, including by manipulating how the operating system locates programs to be executed. How the operating system locates libraries to be used by a program can also be intercepted. Locations where the operating system looks for programs/resources, such as file directories and in the case of Windows the Registry, could also be poisoned to include malicious payloads.
Sub-techniques
- T1574.001 — DLL
- T1574.004 — Dylib Hijacking
- T1574.005 — Executable Installer File Permissions Weakness
- T1574.006 — Dynamic Linker Hijacking
- T1574.007 — Path Interception by PATH Environment Variable
- T1574.008 — Path Interception by Search Order Hijacking
- T1574.009 — Path Interception by Unquoted Path
- T1574.010 — Services File Permissions Weakness
- T1574.011 — Services Registry Permissions Weakness
- T1574.012 — COR_PROFILER
- T1574.013 — KernelCallbackTable
- T1574.014 — AppDomainManager
How GTK Cyber trains on this
GTK Cyber's Threat Hunting with Data Science course teaches you to build machine-learning detections for techniques like this across the MITRE ATT&CK framework, including the stealth, Execution tactic this technique falls under. Practitioner-led, focused on real detections, not memorizing technique IDs.
Related techniques
- T1006 — Direct Volume Access
- T1014 — Rootkit
- T1027 — Obfuscated Files or Information
- T1036 — Masquerading
- T1047 — Windows Management Instrumentation
- T1053 — Scheduled Task/Job
- T1055 — Process Injection
- T1059 — Command and Scripting Interpreter
- T1070 — Indicator Removal
- T1072 — Software Deployment Tools
- T1078 — Valid Accounts
- T1106 — Native API