tfMITRE ATT&CK sub-technique

Path Interception by Search Order Hijacking T1574.008

sub-technique of T1574 Hijack Execution Flow

Tactics: Execution, Stealth
Platform: Windows
Version: 2.0
Created: 13 March 2020
Last modified: 12 May 2026
Contributor: Stefan Kanthak

Adversaries may execute their own malicious payloads by hijacking the search order used to load other programs. Because some programs do not call other programs using the full path, adversaries may place their own file in the directory where the calling program is located, causing the operating system to launch their malicious software at the request of the calling program.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware51st pct

Tools & malware51st percentile · 51% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules54th pct

Detection rules54th percentile · 54% of ATT&CK techniques have this many detection rules written or fewer.

Path Interception by Search Order Hijacking MITRE reference T1574.008

51st pctamong all ATT&CK techniques for number of tools

2 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

EmpireS0363 ↗

Contains modules that can discover and exploit search order hijacking vulnerabilities.1

created 2019-03-11TOOLcarried by 17 groups

PowerSploitS0194 ↗

Contains a collection of Privesc-PowerUp modules that can discover and exploit search order hijacking vulnerabilities.1 2

created 2018-04-18TOOLcarried by 9 groups

All 2 software entries for this technique

Offense vs defense T1574.008

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 2Splunk ESCU (cumulative) · 1

first rule: 2020 Q1

Path Interception by Search Order Hijacking detection strategy DET0564

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for Hijack Execution Flow using Path Interception by Search Order Hijacking

Enterprise

1 platform

AN1560 · Windows

Processes executing binaries named after legitimate system utilities (e.g., net.exe, findstr.exe, python.exe) from non-standard or application-specific directories, combined with file creation or modification events for such binaries. Defender correlates file writes in vulnerable directories, process execution paths inconsistent with baseline system paths, and abnormal parent-child relationships in process lineage.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
File CreationDC0039	WinEventLog:Sysmon	EventCode=11
File MetadataDC0059	WinEventLog:Sysmon	EventCode=15

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
SuspiciousBinaryList	Common system utilities often hijacked (e.g., net.exe, cmd.exe, powershell.exe, python.exe).
MonitoredDirectories	Directories where executables should not normally be written (e.g., application folders, user profile subdirs).
TimeWindow	Correlation window between file creation and subsequent process execution.
ParentProcessBaseline	Expected parent processes for critical system binaries, deviations may indicate hijacking.

1 analytic

The Sysinternals tool Autoruns checks the registry and file system for known identify persistence mechanisms. It will output any tools identified, including built-in or added-on Microsoft functionality and third party software. Many of these locations are known by adversaries and used to obtain Persistence. Running Autoruns periodically in an environment makes it possible to collect and monitor its output for differences, which may include the removal or addition of persistent tools. Depending on the persistence mechanism and location, legitimate software may be more likely to make changes than an adversary tool. Thus, this analytic may result in significant noise in a highly dynamic environment. While Autoruns is a convenient method to scan for programs using persistence mechanisms its scanning nature does not conform well to streaming based analytics. This analytic could be replaced with one that draws from sensors that collect registry and file information if streaming analytics are desired.

TypesSituational Awareness, TTPCoverageModerateSubmitted2013

D3FEND techniques

The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.

ID	Name
D3-SICA	System Init Config Analysis

AuditM1047

Find and eliminate path interception weaknesses in program configuration files, scripts, the PATH environment variable, services, and in shortcuts by surrounding PATH variables with quotation marks when functions allow for them. Be aware of the search order Windows uses for executing or loading binaries and use fully qualified paths wherever appropriate. Clean up old Windows Registry keys when software is uninstalled to avoid keys with no associated legitimate binaries. Periodically search for and correct or report path interception weaknesses on systems that may have been introduced using custom or available tools that report software using insecure path configurations.

Execution PreventionM1038

Adversaries will likely need to place new binaries in locations to be executed through this weakness. Identify and block potentially malicious software executed path interception by using application control tools, like Windows Defender Application Control, AppLocker, or Software Restriction Policies where appropriate.

Restrict File and Directory PermissionsM1022

Ensure that proper permissions and directory access control are set to deny users the ability to write files to the top-level directory C: and system directories, such as C:\Windows\, to reduce places where malicious files could be placed for execution. Require that all executables be placed in write-protected directories.

Tests1ExecutorsPowerShell 1Need elevation0 of 1Have prerequisites0Have cleanup1Platformswindows

#	Test	Platform	Executor	Elevation	Prereqs	Cleanup	Ref
01	powerShell Persistence via hijacking default modules - Get-Variable.exe	windows	PowerShell	—	—	Yes
Colibri leverages PowerShell in a unique way to maintain persistence after a reboot. Depending on the Windows version, Colibri drops its copy in %APPDATA%\Local\Microsoft\WindowsApps and names it Get-Variable.exe for Windows 10 and above. https://blog.malwarebytes.com/threat-intelligence/2022/04/colibri-loader-combines-task-scheduler-and-powershell-in-clever-persistence-technique/ Attack command C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /out:"$env:localappdata\Microsoft\WindowsApps\Get-Variable.exe" "PathToAtomicsFolder\T1574.008\bin\calc.cs" Powershell -noprofile Cleanup command Remove-Item "$env:localappdata\Microsoft\WindowsApps\Get-Variable.exe" -ErrorAction Ignore Stop-Process -Name "calculator" GUID7e4fc17a-09db-484e-995f-f1b267fa7af3

Tests from Atomic Red Team (MIT licence) · technique definition

Path Interception by Search Order Hijacking detections T1574.008

3 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

54th pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs