Detect Hijack Execution Flow in Google Chronicle
This detection identifies adversaries attempting to hijack the operating system's execution flow to run malicious payloads. The detection covers the broad parent technique including DLL hijacking, path interception via unquoted service paths or PATH variable manipulation, dynamic linker hijacking on Linux/macOS, services file and registry permission weaknesses, and application shimming. By monitoring for suspicious image loads from non-standard directories, registry modifications to service image paths, creation of DLLs in directories preceding legitimate ones on the search path, and modifications to shared library paths on Linux, this detection surfaces the most common execution flow hijacking patterns across Windows, Linux, and macOS platforms. Malware families such as DarkGate, ShimRat, Raspberry Robin, and Denis have all leveraged these techniques for persistence and privilege escalation.
MITRE ATT&CK
- Technique
- T1574 Hijack Execution Flow
- Canonical reference
- https://attack.mitre.org/techniques/T1574/
YARA-L Detection Query
rule T1574_hijack_execution {
meta:
author = "Detection Engineering"
description = "Detects execution flow hijacking via installer or DLL path manipulation"
severity = "high"
confidence = "medium"
mitre_attack = "T1574"
reference = "https://attack.mitre.org/techniques/T1574/"
events:
$e.metadata.event_type = "PROCESS_LAUNCH"
(
re.regex($e.target.process.file.full_path, `(?i)\\temp\\.*\.exe`) or
re.regex($e.target.process.file.full_path, `(?i)\\appdata\\.*\.exe`)
)
not re.regex($e.principal.process.file.full_path, `(?i)(msiexec|trustedinstaller|wusa|dpinst)`)
not $e.principal.user.user_display_name = "SYSTEM"
condition:
$e
}Google Chronicle YARA-L 2.0 detection for Hijack Execution Flow. Multi-branch KQL detection covering the four most common Hijack Execution Flow patterns: (1) DLL image loads from user-writable directories when the initiating process is a legitimate system binary, (
Data Sources
Required Tables
False Positives & Tuning
- Legitimate multi-stage installer processes that modify binaries during installation phases
- Enterprise software deployment tools staging installer components in temp directories
- Self-updating applications that download and replace their own binaries
- Archive utilities that extract executables to temp before running them
Other platforms for T1574
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1DLL Search Order Hijack via Missing DLL in System Process Working Directory
Expected signal: Sysmon Event ID 7 (ImageLoaded) with ImageLoaded path pointing to %TEMP%\wlbsctrl.dll. DeviceImageLoadEvents in MDE with FolderPath matching %TEMP%.
- Test 2Service Registry ImagePath Modification to Non-Standard Path
Expected signal: Sysmon Event ID 13 (RegistryValueSet) for HKLM\SYSTEM\CurrentControlSet\Services\DummyTestSvc\ImagePath with value pointing to %TEMP%. Windows Security Event 4657 if object access auditing is enabled.
- Test 3PATH Environment Variable Hijack via User Registry Modification
Expected signal: Sysmon Event ID 13 (RegistryValueSet) for HKCU\Environment\Path with the new value containing the %TEMP% subdirectory. DeviceRegistryEvents in MDE with RegistryValueData containing \Temp\.
- Test 4Linux Dynamic Linker Hijack via LD_PRELOAD
Expected signal: Linux auditd syscall events for the execve/openat calls loading the malicious .so. Syslog entries if auditd is configured to monitor /tmp. Process events showing LD_PRELOAD environment variable set in process spawn context.
References (12)
- https://attack.mitre.org/techniques/T1574/
- https://attack.mitre.org/techniques/T1574/001/
- https://attack.mitre.org/techniques/T1574/004/
- https://attack.mitre.org/techniques/T1574/006/
- https://attack.mitre.org/techniques/T1574/007/
- https://attack.mitre.org/techniques/T1574/008/
- https://attack.mitre.org/techniques/T1574/009/
- https://attack.mitre.org/techniques/T1574/010/
- https://attack.mitre.org/techniques/T1574/011/
- https://docs.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-search-order
- https://www.fox-it.com/en/insights/blogs/tech/mofang-a-politically-motivated-information-stealing-adversary/
- https://www.cyberbit.com/blog/endpoint-security/dtrack-apt-malware-found-in-nuclear-power-plant/
Unlock Pro Content
Get the full detection package for T1574 including response playbook, investigation guide, and atomic red team tests.
Related Detections
Sub-techniques (12)
- T1574.001DLL
- T1574.004Dylib Hijacking
- T1574.005Executable Installer File Permissions Weakness
- T1574.006Dynamic Linker Hijacking
- T1574.007Path Interception by PATH Environment Variable
- T1574.008Path Interception by Search Order Hijacking
- T1574.009Path Interception by Unquoted Path
- T1574.010Services File Permissions Weakness
- T1574.011Services Registry Permissions Weakness
- T1574.012COR_PROFILER
- T1574.013KernelCallbackTable
- T1574.014AppDomainManager