tfMITRE ATT&CK sub-technique

KernelCallbackTable T1574.013

sub-technique of T1574 Hijack Execution Flow

Tactics: Execution, Stealth
Platform: Windows
Version: 2.0
Created: 25 February 2022
Last modified: 12 May 2026

Adversaries may abuse the KernelCallbackTable of a process to hijack its execution flow in order to run their own payloads.[1][2] The KernelCallbackTable can be found in the Process Environment Block (PEB) and is initialized to an array of graphic functions available to a GUI process once user32.dll is loaded.[3]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups45th pct

Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware44th pct

Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

KernelCallbackTable MITRE reference T1574.013

45th pctamong all ATT&CK techniques for number of groups

1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

Lazarus GroupG0032 ↗

Has abused the KernelCallbackTable to hijack process control flow and execute shellcode.1 2

created 2017-05-312 referencesaka Labyrinth Chollima

All 1 groups for this technique

1 software entry is documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

FinFisherS0182 ↗

Has used the KernelCallbackTable to hijack the execution flow of a process by replacing the __fnDWORD function with the address of a created Asynchronous Procedure Call stub routine.1

created 2018-01-16MALWAREcarried by 1 group

All 1 software entries for this technique

Offense vs defense T1574.013

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

KernelCallbackTable detection strategy DET0577

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for Hijack Execution Flow through the KernelCallbackTable on Windows.

Enterprise

1 platform

AN1593 · Windows

Unexpected modification of the KernelCallbackTable in a process’s PEB followed by invocation of modified callback functions (e.g., fnCOPYDATA) through Windows messages. Defender observes suspicious API call chains such as NtQueryInformationProcess → WriteProcessMemory → abnormal GUI callback execution, often correlating to anomalous process behavior such as network activity or code injection.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
OS API ExecutionDC0021	etw:Microsoft-Windows-Kernel-Process	WriteProcessMemory: WriteProcessMemory targeting regions containing KernelCallbackTable addresses
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Process AccessDC0035	WinEventLog:Sysmon	EventCode=10

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
MonitoredProcesses	GUI applications (e.g., explorer.exe, notepad.exe) where KernelCallbackTable abuse is more likely.
CallbackFunctions	Specific callback functions (e.g., fnCOPYDATA, fnDWORD) expected to remain stable.
TimeWindow	Correlation interval between WriteProcessMemory calls and execution of modified callback functions.
AccessMaskThresholds	Access rights values that should be flagged when targeting GUI processes.

KernelCallbackTable detections T1574.013

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs