T1574 Hijack Execution Flow

Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs. MITRE ATT&CK

2 programs on CmdID 3 Sigma rules T1574 on attack.mitre.org

Its sub-techniques

MITRE ATT&CK

T1574.001Hijack Execution Flow: DLL

T1574.005Hijack Execution Flow: Executable Installer File Permissions Weakness

T1574.007Hijack Execution Flow: Path Interception by PATH Environment Variable

T1574.008Hijack Execution Flow: Path Interception by Search Order Hijacking

T1574.011Hijack Execution Flow: Services Registry Permissions Weakness

documented by LOLBAS and GTFOBins, or named by its rules

process creation, the highest levels first

highExploiting SetupComplete.cmd CVE-2019-1378Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro · Windows

mediumDLL Execution Via Register-cimprovider.exeIvan Dyachkov, Yulia Fomina, oscd.community · Windows

mediumRegsvr32 DLL Execution With Uncommon ExtensionFlorian Roth (Nextron Systems) · Windows