Detect Executable Installer File Permissions Weakness in Microsoft Sentinel
Adversaries may hijack binaries used by installer processes by exploiting weak file permissions. Installers frequently extract binaries (EXEs, DLLs) to subdirectories within %TEMP% during installation, often with world-writable permissions. An adversary can overwrite these binaries before the installer executes them, gaining code execution at the installer's privilege level (often SYSTEM or elevated due to UAC elevation). This technique also applies to existing installed software where the binary or its directory has incorrect permissions allowing non-admin users to overwrite it. Mustang Panda has leveraged legitimate installer executables (e.g., Setup Factory IRSetup.exe) to deploy payloads.
MITRE ATT&CK
- Technique
- T1574 Hijack Execution Flow
- Sub-technique
- T1574.005 Executable Installer File Permissions Weakness
- Canonical reference
- https://attack.mitre.org/techniques/T1574/005/
KQL Detection Query
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FolderPath has "\\Temp\\"
| where FileName endswith ".exe"
| where InitiatingProcessFileName in~ ("msiexec.exe", "setup.exe", "install.exe", "installer.exe", "update.exe")
or InitiatingProcessFileName contains "setup"
or InitiatingProcessFileName contains "install"
| join kind=leftouter (
DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType == "FileModified"
| where FileName endswith ".exe" or FileName endswith ".dll"
| where FolderPath has "\\Temp\\"
| project DeviceId, ModifiedFile=FileName, ModifiedPath=FolderPath, ModifyTime=Timestamp, ModifyingProcess=InitiatingProcessFileName
) on DeviceId
| where ModifyTime between ((Timestamp - 5m) .. Timestamp)
| project Timestamp, DeviceName, AccountName, FileName, FolderPath,
InitiatingProcessFileName, ModifiedFile, ModifiedPath, ModifyingProcess
| sort by Timestamp descDetects potential installer hijacking by correlating installer processes executing from TEMP directories with file modification events on EXE/DLL files in those same directories. The key pattern is: an installer running from TEMP that executes a binary that was recently modified by a non-installer process, indicating the binary was overwritten before execution.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate software installers that update extracted files as part of a multi-step installation process
- Self-updating applications that modify their own installer components in TEMP before execution
- Enterprise software deployment systems (SCCM, Intune) that stage and modify installers in temp locations
- Antivirus software that modifies installer binaries as part of scanning or remediation
Other platforms for T1574.005
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Identify World-Writable Installer Directories in TEMP
Expected signal: Sysmon Event ID 1: powershell.exe with Get-Acl command accessing temp directory ACLs. No file modification events. PowerShell ScriptBlock Log Event ID 4104 with the full ACL enumeration script.
- Test 2Simulate Binary Replacement in Installer Temp Directory
Expected signal: Sysmon Event ID 11 (FileCreate): setup_component.exe created in TEMP. Sysmon Event ID 2 (FileCreateTime): file modification timestamp change. Security Event ID 4663 if object access auditing is enabled, showing the file write. icacls process creation events.
- Test 3Check Service Binary Permissions for Hijacking Opportunities
Expected signal: PowerShell process creation events. WMI query to Win32_Service (Sysmon Event ID 19 if WMI monitoring enabled). File ACL access events for each checked service binary path.
Unlock Pro Content
Get the full detection package for T1574.005 including response playbook, investigation guide, and atomic red team tests.