Detect Executable Installer File Permissions Weakness in Sumo Logic CSE
Adversaries may hijack binaries used by installer processes by exploiting weak file permissions. Installers frequently extract binaries (EXEs, DLLs) to subdirectories within %TEMP% during installation, often with world-writable permissions. An adversary can overwrite these binaries before the installer executes them, gaining code execution at the installer's privilege level (often SYSTEM or elevated due to UAC elevation). This technique also applies to existing installed software where the binary or its directory has incorrect permissions allowing non-admin users to overwrite it. Mustang Panda has leveraged legitimate installer executables (e.g., Setup Factory IRSetup.exe) to deploy payloads.
MITRE ATT&CK
- Technique
- T1574 Hijack Execution Flow
- Sub-technique
- T1574.005 Executable Installer File Permissions Weakness
- Canonical reference
- https://attack.mitre.org/techniques/T1574/005/
Sumo Detection Query
_sourceCategory=*sysmon*
| json auto
| where EventCode in ("1","11")
| eval FilePath = if(EventCode = "1", Image, TargetFilename)
| where matches(lower(FilePath), "\\temp\\")
| where matches(lower(FilePath), "(\.exe|\.dll)$")
| eval IsInstaller = if(EventCode = "1" and matches(lower(Image), "(setup|install|msiexec|update)"), "true", "false")
| eval IsBinaryCreate = if(EventCode = "11", "true", "false")
| where User != "NT AUTHORITY\SYSTEM" and !isNull(User)
| eval RiskScore = if(IsInstaller = "true" or IsBinaryCreate = "true", 75, 40)
| stats values(EventCode) AS EventTypes, values(FilePath) AS Files, count AS EventCount by _sourceHost, User, _timeslice 10m
| where EventCount > 1
| sort by EventCount descSumo Logic detection for Executable Installer File Permissions Weakness. Detects potential installer hijacking by correlating installer processes executing from TEMP directories with file modification events on EXE/DLL files in those same directories. The key pattern is: a
Data Sources
Required Tables
False Positives & Tuning
- Multi-stage installers that legitimately modify components in TEMP during installation
- Enterprise deployment solutions staging installer binaries in temporary locations
- Self-updating applications that patch their own binaries before running them
- Software that extracts and immediately executes components from archives
Other platforms for T1574.005
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Identify World-Writable Installer Directories in TEMP
Expected signal: Sysmon Event ID 1: powershell.exe with Get-Acl command accessing temp directory ACLs. No file modification events. PowerShell ScriptBlock Log Event ID 4104 with the full ACL enumeration script.
- Test 2Simulate Binary Replacement in Installer Temp Directory
Expected signal: Sysmon Event ID 11 (FileCreate): setup_component.exe created in TEMP. Sysmon Event ID 2 (FileCreateTime): file modification timestamp change. Security Event ID 4663 if object access auditing is enabled, showing the file write. icacls process creation events.
- Test 3Check Service Binary Permissions for Hijacking Opportunities
Expected signal: PowerShell process creation events. WMI query to Win32_Service (Sysmon Event ID 19 if WMI monitoring enabled). File ACL access events for each checked service binary path.
Unlock Pro Content
Get the full detection package for T1574.005 including response playbook, investigation guide, and atomic red team tests.