CmdID

CmdID / Techniques / T1574

T1574.005 Hijack Execution Flow: Executable Installer File Permissions Weakness

Adversaries may execute their own malicious payloads by hijacking the binaries used by an installer. MITRE ATT&CK

2 Sigma rules T1574.005 on attack.mitre.org

Part of

MITRE ATT&CK
T1574Hijack Execution Flow

Sigma rules tagged with it

process creation, the highest levels first
criticalHackTool - SharpUp PrivEsc Tool ExecutionFlorian Roth (Nextron Systems) · Windows
mediumSetup16.EXE Execution With Custom .Lst Filefrack113 · Windows