Detect Executable Installer File Permissions Weakness in Elastic Security
Adversaries may hijack binaries used by installer processes by exploiting weak file permissions. Installers frequently extract binaries (EXEs, DLLs) to subdirectories within %TEMP% during installation, often with world-writable permissions. An adversary can overwrite these binaries before the installer executes them, gaining code execution at the installer's privilege level (often SYSTEM or elevated due to UAC elevation). This technique also applies to existing installed software where the binary or its directory has incorrect permissions allowing non-admin users to overwrite it. Mustang Panda has leveraged legitimate installer executables (e.g., Setup Factory IRSetup.exe) to deploy payloads.
MITRE ATT&CK
- Technique
- T1574 Hijack Execution Flow
- Sub-technique
- T1574.005 Executable Installer File Permissions Weakness
- Canonical reference
- https://attack.mitre.org/techniques/T1574/005/
Elastic Detection Query
sequence by process.entity_id with maxspan=10m
[file where event.type == "change" and file.name : ("*.exe", "*.dll") and file.path : "*\\Temp\\*"
and not user.name : ("SYSTEM", "TrustedInstaller")]
[process where event.type == "start" and process.executable : "*\\Temp\\*"
and process.parent.name : ("msiexec.exe", "setup.exe", "install.exe")]Elastic EQL detection for Executable Installer File Permissions Weakness. Detects potential installer hijacking by correlating installer processes executing from TEMP directories with file modification events on EXE/DLL files in those same directories. The key pattern is: a
Data Sources
Required Tables
False Positives & Tuning
- Legitimate software installers that update components in TEMP during multi-step installation
- Enterprise deployment tools (SCCM, Intune) staging and modifying binaries in temp locations
- Self-updating applications that modify their own components before execution
- Antivirus software modifying installer binaries during scanning or remediation
Other platforms for T1574.005
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Identify World-Writable Installer Directories in TEMP
Expected signal: Sysmon Event ID 1: powershell.exe with Get-Acl command accessing temp directory ACLs. No file modification events. PowerShell ScriptBlock Log Event ID 4104 with the full ACL enumeration script.
- Test 2Simulate Binary Replacement in Installer Temp Directory
Expected signal: Sysmon Event ID 11 (FileCreate): setup_component.exe created in TEMP. Sysmon Event ID 2 (FileCreateTime): file modification timestamp change. Security Event ID 4663 if object access auditing is enabled, showing the file write. icacls process creation events.
- Test 3Check Service Binary Permissions for Hijacking Opportunities
Expected signal: PowerShell process creation events. WMI query to Win32_Service (Sysmon Event ID 19 if WMI monitoring enabled). File ACL access events for each checked service binary path.
Unlock Pro Content
Get the full detection package for T1574.005 including response playbook, investigation guide, and atomic red team tests.