Pikabot Distribution February 2024C0036 ↗
Utilized a tampered legitimate executable, grepWinNP3.exe, for its first stage Pikabot loader, modifying the open-source tool to execute malicious code when launched.1
tfMITRE ATT&CK technique
Hijack Execution Flow T1574
- Platforms
- Linux, macOS, Windows
- Version
- 2.0
- Created
- 12 March 2020
- Last modified
- 12 May 2026
Sub-techniques 12156 rules across the family · 14 mapped directly to T1574 · 10 of 12 carry rules
.001DLL110.004Dylib Hijacking0.005Executable Installer File Permissions Weakness2.006Dynamic Linker Hijacking7.007Path Interception by PATH Environment Variable4.008Path Interception by Search Order Hijacking3.009Path Interception by Unquoted Path1.010Services File Permissions Weakness1.011Services Registry Permissions Weakness13.012COR_PROFILER2.013KernelCallbackTable0.014AppDomainManager1
Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs. Hijacking execution flow can be for the purposes of persistence, since this hijacked execution may reoccur over time. Adversaries may also use these mechanisms to elevate privileges or evade defenses, such as application control or other restrictions on execution.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
0
Threat groupsNone recorded
Threat groupsNone recorded · 29% of ATT&CK techniques have none either.2
CampaignsTop 17%
Campaigns83rd percentile · 83% of ATT&CK techniques have this many campaigns recorded or fewer.9
Tools & malware73rd pct
Tools & malware73rd percentile · 73% of ATT&CK techniques have this many tools implementing them or fewer.14
Detection rulesTop 18%
Detection rules82nd percentile · 82% of ATT&CK techniques have this many detection rules written or fewer.Hijack Execution Flow MITRE reference T1574
Top 17%of all ATT&CK techniques for number of campaigns
2 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
C0017C0017 ↗
During C0017, APT41 established persistence by loading malicious libraries via modifications to the Import Address Table (IAT) within legitimate Microsoft binaries.1
All 2 campaigns for this technique
9 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
SPAWNCHIMERAS9024 ↗
Can persist across system upgrades by hijacking the execution flow of dspkginstall, a binary used during the system upgrade process.12
NightdoorS1147 ↗
Uses a legitimate executable to load a malicious DLL file for installation.1
Raspberry RobinS1130 ↗
Will drop a copy of itself to a subfolder in %Program Data% or %Program Data%\\Microsoft\\ to attempt privilege elevation and defense evasion if not running in Session 0.1
DarkGateS1111 ↗
Edits the Registry key HKCU\Software\Classes\mscfile\shell\open\command to execute a malicious AutoIt script.1 When eventvwr.exe is executed, this will call the Microsoft Management Console (mmc.exe), which in turn references the modified Registry key.
COATHANGERS1105 ↗
Will remove and write malicious shared objects associated with legitimate system functions such as read(2).1
Saint BotS1018 ↗
Will use the malicious file slideshow.mp4 if present to load the core API provided by ntdll.dll to avoid any hooks placed on calls to the original ntdll.dll file by endpoint detection and response or antimalware software.1
All 9 software entries for this technique · 6 newest in this preview
Offense vs defense T1574
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 2Sigma rules (cumulative) · 9Splunk ESCU (cumulative) · 5
first rule: 2019 Q3 · 2 of 2 campaigns plottedHijack Execution Flow detection strategy DET0218
MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection Strategy for Hijack Execution Flow across OS platforms.
3 platforms
AN0609 · Windows
Unusual modifications to service binary paths, registry keys, or DLL load paths resulting in alternate execution flow. Defender observes registry key modifications, suspicious file writes into system directories, and processes loading libraries from abnormal paths.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Module LoadDC0016 | WinEventLog:Sysmon | EventCode=7 |
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
| File CreationDC0039 | WinEventLog:Sysmon | EventCode=11 |
| Windows Registry Key ModificationDC0063 | WinEventLog:Security | EventCode=4657 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ServiceBaseline | Expected registry keys and service paths for comparison. |
| AllowedDllPaths | Directories considered valid for DLL loading. |
| TimeWindow | Correlation interval between registry/file modification and process execution. |
AN0610 · Linux
Adversary manipulation of shared library paths, environment variables, or replacement of service binaries. Defender observes suspicious modifications in /etc/ld.so.preload, service config changes, or file writes replacing existing executables.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | linux:osquery | Process execution with LD_PRELOAD or modified library path |
| Service MetadataDC0041 | linux:syslog | Service restart with modified executable path |
| File ModificationDC0061 | auditd:SYSCALL | open/write syscalls targeting /etc/ld.so.preload or binaries in /usr/bin |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| MonitoredDirectories | Directories where binary replacement should trigger alerts. |
| EnvVarMonitors | Environment variables like LD_PRELOAD or PATH to monitor. |
AN0611 · macOS
Abuse of DYLD_INSERT_LIBRARIES or hijacking framework paths for malicious libraries. Defender observes processes invoking abnormal dylibs, modified plist files, or persistence entries pointing to altered binaries.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Module LoadDC0016 | macos:unifiedlog | Dylib loaded from abnormal location |
| Process CreationDC0032 | macos:unifiedlog | Execution of process with DYLD_INSERT_LIBRARIES set |
| File ModificationDC0061 | macos:unifiedlog | Modified application plist or binary replacement in /Applications |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| AllowedDylibPaths | Baseline directories for dylib loading. |
| PlistMonitors | Specific plist files used for persistence monitoring. |
When possible, include hash values in manifest files to help prevent side-loading of malicious libraries.
AuditM1047
Use auditing tools capable of detecting hijacking opportunities on systems within an enterprise and correct them. Toolkits like the PowerSploit framework contain PowerUp modules that can be used to explore systems for hijacking weaknesses. Use the program sxstrace.exe that is included with Windows along with manual inspection to check manifest files for side-loading vulnerabilities in software. Find and eliminate path interception weaknesses in program configuration files, scripts, the PATH environment variable, services, and in shortcuts by surrounding PATH variables with quotation marks when functions allow for them. Be aware of the search order Windows uses for executing or loading binaries and use fully qualified paths wherever appropriate. Clean up old Windows Registry keys when software is uninstalled to avoid keys with no associated legitimate binaries. Periodically search for and correct or report path interception weaknesses on systems that may have been introduced using custom or available tools that report software using insecure path configurations.
Some endpoint security solutions can be configured to block some types of behaviors related to process injection/memory tampering based on common sequences of indicators (ex: execution of specific API functions).
Execution PreventionM1038
Adversaries may use new payloads to execute this technique. Identify and block potentially malicious software executed through hijacking by using application control solutions also capable of blocking libraries loaded by legitimate software.
Install software in write-protected locations. Set directory access controls to prevent file writes to the search paths for applications, both in the folders where applications are run from and the standard library folders.
Disallow loading of remote DLLs. This is included by default in Windows Server 2012+ and is available by patch for XP+ and Server 2003+.
Enable Safe DLL Search Mode to force search for system DLLs in directories with greater restrictions (e.g. %SYSTEMROOT%)to be used before local directory DLLs (e.g. a user's home directory)
The Safe DLL Search Mode can be enabled via Group Policy at Computer Configuration > [Policies] > Administrative Templates > MSS (Legacy): MSS: (SafeDllSearchMode) Enable Safe DLL search mode. The associated Windows Registry key for this is located at HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\SafeDLLSearchMode
Ensure proper permissions are set for Registry hives to prevent users from modifying keys for system components that may lead to privilege escalation.
Update SoftwareM1051
Update software regularly to include patches that fix DLL side-loading vulnerabilities.
User Account ControlM1052
Turn off UAC's privilege elevation for standard users [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System] to automatically deny elevation requests, add: "ConsentPromptBehaviorUser"=dword:00000000. Consider enabling installer detection for all users by adding: "EnableInstallerDetection"=dword:00000001. This will prompt for a password for installation and also log the attempt. To disable installer detection, instead add: "EnableInstallerDetection"=dword:00000000. This may prevent potential elevation of privileges through exploitation during the process of UAC detecting the installer, but will allow the installation process to continue without being logged.
Limit privileges of user accounts and groups so that only authorized administrators can interact with service changes and service binary target path locations. Deny execution from user directories such as file download directories and temp directories where able.
Ensure that proper permissions and directory access control are set to deny users the ability to write files to the top-level directory C: and system directories, such as C:\Windows\, to reduce places where malicious files could be placed for execution.