Detect Executable Installer File Permissions Weakness in Splunk
Adversaries may hijack binaries used by installer processes by exploiting weak file permissions. Installers frequently extract binaries (EXEs, DLLs) to subdirectories within %TEMP% during installation, often with world-writable permissions. An adversary can overwrite these binaries before the installer executes them, gaining code execution at the installer's privilege level (often SYSTEM or elevated due to UAC elevation). This technique also applies to existing installed software where the binary or its directory has incorrect permissions allowing non-admin users to overwrite it. Mustang Panda has leveraged legitimate installer executables (e.g., Setup Factory IRSetup.exe) to deploy payloads.
MITRE ATT&CK
- Technique
- T1574 Hijack Execution Flow
- Sub-technique
- T1574.005 Executable Installer File Permissions Weakness
- Canonical reference
- https://attack.mitre.org/techniques/T1574/005/
SPL Detection Query
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational"
| eval event_type=case(
EventCode=1, "process",
EventCode=11, "file_create",
true(), "other")
| where event_type in ("process", "file_create")
| eval temp_path=if(event_type="process",
if(match(lower(Image), "\\\\temp\\\\"), 1, 0),
if(match(lower(TargetFilename), "\\\\temp\\\\"), 1, 0))
| where temp_path=1
| eval is_installer=if(event_type="process" AND match(lower(Image), "(setup|install|msiexec|update)"), 1, 0)
| eval is_binary=if(event_type="file_create" AND match(TargetFilename, "(\.exe|\.dll)$"), 1, 0)
| stats values(event_type) as types, values(Image) as processes, values(TargetFilename) as files by host, span(_time, 10m)
| where mvcount(types) > 1 AND mvcount(files) > 0
| sort - _timeDetects potential installer hijacking by correlating installer process execution (Sysmon EventCode 1) with file creation/modification events (EventCode 11) for EXE/DLL files in TEMP directories within a 10-minute window. This catches the timing attack pattern where an adversary modifies installer-extracted binaries before they are executed.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Multi-stage installers that legitimately modify extracted components
- SCCM/Intune deployment agents staging installer components
- Update mechanisms that patch installer binaries before running them
- Archive extraction tools that write executables to temp before running them
Other platforms for T1574.005
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Identify World-Writable Installer Directories in TEMP
Expected signal: Sysmon Event ID 1: powershell.exe with Get-Acl command accessing temp directory ACLs. No file modification events. PowerShell ScriptBlock Log Event ID 4104 with the full ACL enumeration script.
- Test 2Simulate Binary Replacement in Installer Temp Directory
Expected signal: Sysmon Event ID 11 (FileCreate): setup_component.exe created in TEMP. Sysmon Event ID 2 (FileCreateTime): file modification timestamp change. Security Event ID 4663 if object access auditing is enabled, showing the file write. icacls process creation events.
- Test 3Check Service Binary Permissions for Hijacking Opportunities
Expected signal: PowerShell process creation events. WMI query to Win32_Service (Sysmon Event ID 19 if WMI monitoring enabled). File ACL access events for each checked service binary path.
Unlock Pro Content
Get the full detection package for T1574.005 including response playbook, investigation guide, and atomic red team tests.