Cross-source coverage

T1574.007 / ATT&CK

Hijack Execution Flow: Path Interception by PATH Environment Variable

10 rules across 4 sources.

1 deprecated hidden · include

From MITRE ATT&CK 19.2

Adversaries may execute their own malicious payloads by hijacking environment variables used to load libraries. The PATH environment variable contains a list of directories (User and System) that the OS searches sequentially through in search of the binary that was called from a script or the command line.

Adversaries can place a malicious program in an earlier entry in the list of directories stored in the PATH environment variable, resulting in the operating system executing the malicious binary rather than the legitimate binary when it searches sequentially through that PATH listing.

For example, on Windows if an adversary places a malicious program named "net.exe" in C:\example path, which by default precedes C:\Windows\system32\net.exe in the PATH environment variable, when "net" is executed from the command-line the C:\example path will be called instead of the system's legitimate executable at C:\Windows\system32\net.exe. Some methods of executing a program rely on the PATH environment variable to determine the locations that are searched when the path for the program is not given, such as executing programs from a Command and Scripting Interpreter.

Adversaries may also directly modify the $PATH variable specifying the directories to be searched. An adversary can modify the $PATH variable to point to a directory they have write access. When a program using the $PATH variable is called, the OS searches the specified directory and executes the malicious binary. On macOS, this can also be performed through modifying the $HOME variable. These variables can be modified using the command-line, launchctl, Unix Shell Configuration Modification, or modifying the /etc/paths.d folder contents.

Tactics
Stealth · Execution
Platforms
Linux · macOS · Windows
Telemetry
WinEventLog:SecurityWinEventLog:Sysmonauditd:SYSCALLlinux:osquerymacos:unifiedlog

How MITRE says to detect it DET0004

Detection Strategy for Hijack Execution Flow using Path Interception by PATH Environment Variable.

Windows Analytic 0009

Abnormal modification of the PATH environment variable or registry keys controlling system paths, combined with execution of binaries named after legitimate system tools from user-writable directories. Defender correlates registry modifications, file creation of suspicious binaries, and process execution paths inconsistent with baseline system directories.

  • WinEventLog:Security EventCode=4657
  • WinEventLog:Sysmon EventCode=11
  • WinEventLog:Sysmon EventCode=1

Linux Analytic 0010

User modification of the $PATH environment variable in shell configuration files or direct runtime PATH changes, followed by execution of binaries from user-controlled directories. Defender observes file edits to ~/.bashrc, ~/.profile, or /etc/paths.d and process execution resolving to unexpected binary locations.

  • auditd:SYSCALL open/write calls modifying ~/.bashrc, ~/.profile, or /etc/paths.d
  • linux:osquery Execution of binary resolved from $PATH not located in /usr/bin or /bin

macOS Analytic 0011

Modification of PATH or HOME environment variables through shell config files, launchctl, or /etc/paths.d entries, combined with process execution from attacker-controlled directories. Defender correlates file changes in /etc/paths.d with process execution resolving to malicious binaries.

  • macos:unifiedlog File modification in /etc/paths.d or user shell rc files
  • macos:unifiedlog Process execution path inconsistent with baseline PATH directories

View on attack.mitre.org ↗

elastic/detection-rules

4 rules
Detection Severity Format
Potential Privilege Escalation via PKEXEC High Elastic TOML
Privilege Escalation via Windir Environment Variable High Elastic TOML
Modification of Environment Variable via Unsigned or Untrusted Parent Medium Elastic TOML
Suspicious Path Invocation from Command Line Low Elastic TOML

SigmaHQ/sigma

2 rules
Detection Severity Format
Trusted Path Bypass via Windows Directory Spoofing High Sigma
Potential Suspicious Activity Using SeCEdit Medium Sigma

elastic/protections-artifacts

2 rules
Detection Severity Format
Privilege Escalation via PKEXEC Exploitation Undefined Elastic TOML
Privilege Escalation via Windir or SystemRoot Environment Variable Undefined Elastic TOML

splunk/security_content

2 rules
Detection Severity Format
Linux Possible Privilege Escalation via PYTHONPATH Undefined SPL
Python PYTHONPATH Modification During Package Installation Undefined SPL

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.