Cross-source coverage

T1574 / ATT&CK

Hijack Execution Flow

328 rules · 325 families across 8 sources.

7 deprecated hidden · include

From MITRE ATT&CK 19.2

Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs. Hijacking execution flow can be for the purposes of persistence, since this hijacked execution may reoccur over time. Adversaries may also use these mechanisms to elevate privileges or evade defenses, such as application control or other restrictions on execution.

There are many ways an adversary may hijack the flow of execution, including by manipulating how the operating system locates programs to be executed. How the operating system locates libraries to be used by a program can also be intercepted. Locations where the operating system looks for programs/resources, such as file directories and in the case of Windows the Registry, could also be poisoned to include malicious payloads.

Tactics: Stealth · Execution
Platforms: Linux · macOS · Windows
Telemetry: WinEventLog:SysmonWinEventLog:Securityauditd:SYSCALLlinux:sysloglinux:osquerymacos:unifiedlog

How MITRE says to detect it DET0218

Detection Strategy for Hijack Execution Flow across OS platforms.

Windows Analytic 0609

Unusual modifications to service binary paths, registry keys, or DLL load paths resulting in alternate execution flow. Defender observes registry key modifications, suspicious file writes into system directories, and processes loading libraries from abnormal paths.

WinEventLog:Sysmon EventCode=1
WinEventLog:Sysmon EventCode=7
WinEventLog:Security EventCode=4657
WinEventLog:Sysmon EventCode=11

Linux Analytic 0610

Adversary manipulation of shared library paths, environment variables, or replacement of service binaries. Defender observes suspicious modifications in /etc/ld.so.preload, service config changes, or file writes replacing existing executables.

auditd:SYSCALL open/write syscalls targeting /etc/ld.so.preload or binaries in /usr/bin
linux:syslog Service restart with modified executable path
linux:osquery Process execution with LD_PRELOAD or modified library path

macOS Analytic 0611

Abuse of DYLD_INSERT_LIBRARIES or hijacking framework paths for malicious libraries. Defender observes processes invoking abnormal dylibs, modified plist files, or persistence entries pointing to altered binaries.

macos:unifiedlog Execution of process with DYLD_INSERT_LIBRARIES set
macos:unifiedlog Modified application plist or binary replacement in /Applications
macos:unifiedlog Dylib loaded from abnormal location

View on attack.mitre.org ↗

Sub-techniques with coverage

Counted in the 328 above — a rule tagged a sub-technique covers this technique too.

SigmaHQ/sigma

121 rules

Detection	Severity	Format
APT27 - Emissary Panda Activity	Critical	Sigma
HackTool - SharpUp PrivEsc Tool Execution	Critical	Sigma
Winnti Malware HK University Campaign	Critical	Sigma
Winnti Pipemon Characteristics	Critical	Sigma
Abuse of Service Permissions to Hide Services Via Set-Service	High	Sigma
Abuse of Service Permissions to Hide Services Via Set-Service - PS	High	Sigma
Aruba Network Service Potential DLL Sideloading	High	Sigma
Code Injection by ld.so Preload	High	Sigma
DHCP Callout DLL Installation	High	Sigma
DHCP Server Error Failed Loading the CallOut DLL	High	Sigma

+ 111 more from SigmaHQ/sigma → showing the 10 highest-severity

elastic/detection-rules

73 rules

Detection	Severity	Format
Dylib Injection via Process Environment Variables	High	Elastic TOML
Dynamic Linker Copy	High	Elastic TOML
Dynamic Linker Modification Detected via Defend for Containers	High	Elastic TOML
Persistence via TelemetryController Scheduled Task Hijack	High	Elastic TOML
Persistence via Update Orchestrator Service Hijack	High	Elastic TOML
Potential CVE-2025-32463 Nsswitch File Creation	High	Elastic TOML
Potential Masquerading as System32 DLL	High	Elastic TOML
Potential privilege escalation via CVE-2022-38028	High	Elastic TOML
Potential Privilege Escalation via InstallerFileTakeOver	High	Elastic TOML
Potential Privilege Escalation via PKEXEC	High	Elastic TOML

+ 63 more from elastic/detection-rules → showing the 10 highest-severity

elastic/protections-artifacts

72 rules

Detection	Severity	Format
BindFltApi Loaded by an Unusual Process	Undefined	Elastic TOML
Default Application Hijacking	Undefined	Elastic TOML
DLL Dropped by MSIEXEC followed by SideLoad	Undefined	Elastic TOML
DLL Side Loading of a file dropped by Microsoft Office	Undefined	Elastic TOML
DLL Side Loading via a Copied Microsoft Executable	Undefined	Elastic TOML
Dylib Loaded by Process in Suspicious Location	Undefined	Elastic TOML
Dylib Load via SSH-Keygen	Undefined	Elastic TOML
Egress Connection by a DNF Package Manager Descendant	Undefined	Elastic TOML
Egress Connection by a YUM Package Manager Descendant	Undefined	Elastic TOML
Egress Network Connection from Default DPKG Directory	Undefined	Elastic TOML

+ 62 more from elastic/protections-artifacts → showing the 10 highest-severity

splunk/security_content

34 rules

Detection	Severity	Format
Detect Path Interception By Creation Of program exe	Undefined	SPL
GitHub Workflow File Creation or Modification	Undefined	SPL
Linux Auditd Preload Hijack Library Calls	Undefined	SPL
Linux Auditd Preload Hijack Via Preload File	Undefined	SPL
Linux Possible Privilege Escalation via PYTHONPATH	Undefined	SPL
Linux Preload Hijack Library Calls	Undefined	SPL
MSI Module Loaded by Non-System Binary	Undefined	SPL
Msmpeng Application DLL Side Loading	Undefined	SPL
Python PYTHONPATH Modification During Package Installation	Undefined	SPL
Reg exe Manipulating Windows Services Registry Keys	Undefined	SPL

+ 24 more from splunk/security_content → showing the 10 highest-severity

socfortress/Wazuh-Rules

19 rules · 17 families

Detection	Severity	Format
Identifies modification of ld.so.preload for shared object injection. This technique is used by attackers to load arbitrary code into processes. 2 variants	High	Wazuh XML
Identifies modification of ld.so.preload for shared object injection. This technique is used by attackers to load arbitrary code into processes. 2 variants	High	Wazuh XML
Potential LD_PRELOAD hijack detected (T1574.006)	High	Wazuh XML
Sysmon - Event 1: Process creation · CLR Process Trigger (Event Viewer) (T1574.012)	High	Wazuh XML
Sysmon - Event 1: Process creation · CLR Process Trigger (User/Proc Scope) (T1574.012)	High	Wazuh XML
Sysmon - Event 1: Process creation · dotnet.exe with DOTNET_STARTUP_HOOKS (T1574.001)	High	Wazuh XML
Sysmon - Event 1: Process creation · Executed fake Get-Variable.exe in WindowsApps (T1574.008)	High	Wazuh XML
Sysmon - Event 1: Process creation · GUP.exe DLL Sideloading (T1574.001)	High	Wazuh XML
Sysmon - Event 1: Process creation · KeyScrambler.exe DLL Sideloading (T1574.001)	High	Wazuh XML
Sysmon - Event 1: Process creation · Suspicious Execution of Get-Variable.exe (T1574.008)	High	Wazuh XML

+ 9 more from socfortress/Wazuh-Rules → showing the 10 highest-severity

Wazuh Core Ruleset

5 rules

Detection	Severity	Format
Windows Defender executed from suspicious path, possible DLL side-loading	Critical	Wazuh XML
DLL file created by printer spool service, possible malware binary drop from PrintNightmare exploit	High	Wazuh XML
binary created in Windows root folder by WinRM process · win.eventdata.image = (?i)wsmprovhost\.exe	Medium	Wazuh XML
Possible DLL search order hijack by created in Windows root folder · win.eventdata.image = (?i)svchost\.exe, win.eventdata.targetFilename = (?i)[c-z]:\\\\Windows\\\\.+\.dll	Medium	Wazuh XML
A binary was started by a Windows cmd shell · win.eventdata.originalFileName = (?i)(SystemPropertiesAdvanced\|net)\.EXE	Low	Wazuh XML

Azure/Azure-Sentinel

3 rules

Detection	Severity	Format
First-Time Network Connection by Unusual Process	High	KQL
COM Registry Key Modified to Point to File in Color Profile Folder	Medium	KQL
Gentlemen Ransomware payload execution and staging	Undefined	KQL

Bert-JanP/Hunting-Queries-Detection-Rules

1 rule

Detection	Severity	Format
Smoke Sandstorm - SnailResin and SlugResin Infection Detection	Undefined	KQL