Detect Hijack Execution Flow in Elastic Security
This detection identifies adversaries attempting to hijack the operating system's execution flow to run malicious payloads. The detection covers the broad parent technique including DLL hijacking, path interception via unquoted service paths or PATH variable manipulation, dynamic linker hijacking on Linux/macOS, services file and registry permission weaknesses, and application shimming. By monitoring for suspicious image loads from non-standard directories, registry modifications to service image paths, creation of DLLs in directories preceding legitimate ones on the search path, and modifications to shared library paths on Linux, this detection surfaces the most common execution flow hijacking patterns across Windows, Linux, and macOS platforms. Malware families such as DarkGate, ShimRat, Raspberry Robin, and Denis have all leveraged these techniques for persistence and privilege escalation.
MITRE ATT&CK
- Technique
- T1574 Hijack Execution Flow
- Canonical reference
- https://attack.mitre.org/techniques/T1574/
Elastic Detection Query
any where
(event.category == "library" and dll.path : ("*\\AppData\\*", "*\\Temp\\*", "*\\ProgramData\\*")
and not process.name : ("svchost.exe", "msiexec.exe"))
or
(event.category == "process" and event.type == "start"
and process.name : ("net.exe", "cmd.exe", "powershell.exe")
and not process.executable : "C:\\Windows\\*")Elastic EQL detection for Hijack Execution Flow. Multi-branch KQL detection covering the four most common Hijack Execution Flow patterns: (1) DLL image loads from user-writable directories when the initiating process is a legitimate system binary, (
Data Sources
Required Tables
False Positives & Tuning
- Legitimate software installers that update components in TEMP during multi-step installation
- Enterprise deployment tools (SCCM, Intune) staging and modifying binaries in temp locations
- Self-updating applications that modify their own components before execution
- Antivirus software modifying installer binaries during scanning or remediation
Other platforms for T1574
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1DLL Search Order Hijack via Missing DLL in System Process Working Directory
Expected signal: Sysmon Event ID 7 (ImageLoaded) with ImageLoaded path pointing to %TEMP%\wlbsctrl.dll. DeviceImageLoadEvents in MDE with FolderPath matching %TEMP%.
- Test 2Service Registry ImagePath Modification to Non-Standard Path
Expected signal: Sysmon Event ID 13 (RegistryValueSet) for HKLM\SYSTEM\CurrentControlSet\Services\DummyTestSvc\ImagePath with value pointing to %TEMP%. Windows Security Event 4657 if object access auditing is enabled.
- Test 3PATH Environment Variable Hijack via User Registry Modification
Expected signal: Sysmon Event ID 13 (RegistryValueSet) for HKCU\Environment\Path with the new value containing the %TEMP% subdirectory. DeviceRegistryEvents in MDE with RegistryValueData containing \Temp\.
- Test 4Linux Dynamic Linker Hijack via LD_PRELOAD
Expected signal: Linux auditd syscall events for the execve/openat calls loading the malicious .so. Syslog entries if auditd is configured to monitor /tmp. Process events showing LD_PRELOAD environment variable set in process spawn context.
References (12)
- https://attack.mitre.org/techniques/T1574/
- https://attack.mitre.org/techniques/T1574/001/
- https://attack.mitre.org/techniques/T1574/004/
- https://attack.mitre.org/techniques/T1574/006/
- https://attack.mitre.org/techniques/T1574/007/
- https://attack.mitre.org/techniques/T1574/008/
- https://attack.mitre.org/techniques/T1574/009/
- https://attack.mitre.org/techniques/T1574/010/
- https://attack.mitre.org/techniques/T1574/011/
- https://docs.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-search-order
- https://www.fox-it.com/en/insights/blogs/tech/mofang-a-politically-motivated-information-stealing-adversary/
- https://www.cyberbit.com/blog/endpoint-security/dtrack-apt-malware-found-in-nuclear-power-plant/
Unlock Pro Content
Get the full detection package for T1574 including response playbook, investigation guide, and atomic red team tests.
Related Detections
Sub-techniques (12)
- T1574.001DLL
- T1574.004Dylib Hijacking
- T1574.005Executable Installer File Permissions Weakness
- T1574.006Dynamic Linker Hijacking
- T1574.007Path Interception by PATH Environment Variable
- T1574.008Path Interception by Search Order Hijacking
- T1574.009Path Interception by Unquoted Path
- T1574.010Services File Permissions Weakness
- T1574.011Services Registry Permissions Weakness
- T1574.012COR_PROFILER
- T1574.013KernelCallbackTable
- T1574.014AppDomainManager