1. Home
  2. ATT&CK Techniques
  3. T1574 Hijack Execution Flow

T1574 Hijack Execution Flow

Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs. Hijacking execution flow can be for the purposes of persistence, since this hijacked execution may reoccur over time. Adversaries may also use these mechanisms to elevate privileges or evade defenses, such as application control or other restrictions on execution.

There are many ways an adversary may hijack the flow of execution, including by manipulating how the operating system locates programs to be executed. How the operating system locates libraries to be used by a program can also be intercepted. Locations where the operating system looks for programs/resources, such as file directories and in the case of Windows the Registry, could also be poisoned to include malicious payloads.

View in MITRE ATT&CK®

CIS Controls Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
CIS-13.7 Deploy a Host-Based Intrusion Prevention Solution mitigates T1574 Hijack Execution Flow
Comments
Endpoint security solutions can block behaviors associated with process injection or memory tampering based on common sequences of indicators such as suspicious API usage.
References
  1. https://cas.docs.cisecurity.org/en/latest/source/Controls13/#137-deploy-a-host-based-intrusion-prevention-solution
CIS-6.8 Define and Maintain Role-Based Access Control mitigates T1574 Hijack Execution Flow
Comments
Using role-based access control (RBAC) to limit permissions to modify service configurations, registry settings, and protected file paths to users with a legitimate need can help prevent adversaries from hijacking execution flow.
References
  1. https://cas.docs.cisecurity.org/en/latest/source/Controls6/#68-define-and-maintain-role-based-access-control
CIS-7.7 Remediate Detected Vulnerabilities mitigates T1574 Hijack Execution Flow
Comments
Remediation can correct vulnerable library-loading behavior and unsafe execution paths in affected software. Many other execution-flow hijacking methods depend on writable paths, permissions, or configuration rather than a software vulnerability.
References
  1. https://cas.docs.cisecurity.org/en/latest/source/Controls7/#77-remediate-detected-vulnerabilities
CIS-7.4 Perform Automated Application Patch Management mitigates T1574 Hijack Execution Flow
Comments
Application updates can correct unsafe DLL search paths and other software defects that permit DLL side-loading. Most other execution-flow hijacking implementations require permissions, application control, or operating-system configuration protections.
References
  1. https://cas.docs.cisecurity.org/en/latest/source/Controls7/#74-perform-automated-application-patch-management
CIS-16.11 Leverage Vetted Modules or Services for Application Security Components mitigates T1574 Hijack Execution Flow
Comments
Use vetted platform services and trusted application security modules that validate component integrity; where applicable, include hash values in manifest files to help prevent malicious library side-loading.
References
  1. https://cas.docs.cisecurity.org/en/latest/source/Controls16/#1611-leverage-vetted-modules-or-services-for-application-security-components
CIS-16.10 Apply Secure Design Principles in Application Architectures mitigates T1574 Hijack Execution Flow
Comments
Applying secure design principles to include hash values in manifest files, where possible, can help prevent adversaries from hijacking the way operating systems run programs and executing their own malicious payloads.
References
  1. https://cas.docs.cisecurity.org/en/latest/source/Controls16/#1610-apply-secure-design-principles-in-application-architectures
CIS-16.12 Implement Code-Level Security Checks mitigates T1574 Hijack Execution Flow
Comments
Code-level and build-time security checks can identify unsafe executable or library search paths, missing integrity values, and other application-loading conditions that permit adversaries to hijack execution flow, allowing those weaknesses to be corrected before release.
References
  1. https://cas.docs.cisecurity.org/en/latest/source/Controls16/#1612-implement-code-level-security-checks

VERIS Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
action.hacking.variety.Hijack To assume control over and steal functionality for an illicit purpose (e.g. Hijacking phone number intercept SMS verification codes) related-to T1574 Hijack Execution Flow
action.hacking.variety.Unknown Unknown related-to T1574 Hijack Execution Flow
action.hacking.variety.XML injection XML injection. Child of 'Exploit vuln'. related-to T1574 Hijack Execution Flow

GCP Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
google_secops Google Security Operations technique_scores T1574 Hijack Execution Flow
Comments
Google Security Ops is able to trigger alerts based on suspicious system processes that could indicate hijacking via malicious payloads. This technique was scored as minimal based on low or uncertain detection coverage factor. https://github.com/chronicle/detection-rules/blob/783e0e5947774785db1c55041b70176deeca6f46/soc_prime_rules/threat_hunting/antivirus/detects_powershell_attack__via_av_ids.yaral
References
  1. https://cloud.google.com/security/products/security-operations
  2. https://cloud.google.com/chronicle/docs/secops/secops-overview
  3. https://github.com/chronicle/detection-rules

ATT&CK Subtechniques

Technique ID Technique Name Number of Mappings
T1574.007 Path Interception by PATH Environment Variable 1
T1574.011 Services Registry Permissions Weakness 1
T1574.001 DLL 10
T1574.014 AppDomainManager 2
T1574.006 Dynamic Linker Hijacking 1
T1574.005 Executable Installer File Permissions Weakness 4
T1574.010 Services File Permissions Weakness 2
T1574.013 KernelCallbackTable 2
T1574.004 Dylib Hijacking 3
T1574.012 COR_PROFILER 3