CmdID

CmdID / Techniques / T1574

T1574.008 Hijack Execution Flow: Path Interception by Search Order Hijacking

Adversaries may execute their own malicious payloads by hijacking the search order used to load other programs. MITRE ATT&CK

2 Sigma rules T1574.008 on attack.mitre.org

Part of

MITRE ATT&CK
T1574Hijack Execution Flow

Sigma rules tagged with it

process creation, the highest levels first
highPotential Notepad++ CVE-2025-49144 ExploitationSwachchhanda Shrawan Poudel (Nextron Systems) · Windows
highUsing SettingSyncHost.exe as LOLBinAnton Kutepov, oscd.community · Windows