T1574 Splunk · SPL

Detect Hijack Execution Flow in Splunk

This detection identifies adversaries attempting to hijack the operating system's execution flow to run malicious payloads. The detection covers the broad parent technique including DLL hijacking, path interception via unquoted service paths or PATH variable manipulation, dynamic linker hijacking on Linux/macOS, services file and registry permission weaknesses, and application shimming. By monitoring for suspicious image loads from non-standard directories, registry modifications to service image paths, creation of DLLs in directories preceding legitimate ones on the search path, and modifications to shared library paths on Linux, this detection surfaces the most common execution flow hijacking patterns across Windows, Linux, and macOS platforms. Malware families such as DarkGate, ShimRat, Raspberry Robin, and Denis have all leveraged these techniques for persistence and privilege escalation.

MITRE ATT&CK

Tactic
Persistence Privilege Escalation Defense Evasion
Technique
T1574 Hijack Execution Flow
Canonical reference
https://attack.mitre.org/techniques/T1574/

SPL Detection Query

Splunk (SPL)
spl 
index=* earliest=-24h
(sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" OR sourcetype="WinEventLog:Security")
| eval technique=""
| eval score=0
```Branch 1: Sysmon EventCode 7 - Image Load from suspicious path```
| where (EventCode=7 AND ImageLoaded!="" AND NOT match(ImageLoaded, "(?i)C:\\Windows\\(System32|SysWOW64|WinSxS)") AND match(ImageLoaded, "(?i)(\\Users\\|\\Temp\\|\\AppData\\|\\ProgramData\\|\\Downloads\\)") AND match(Image, "(?i)C:\\Windows\\"))
   OR
```Branch 2: Sysmon EventCode 13 - Registry value set for service ImagePath```
   (EventCode=13 AND TargetObject LIKE "%CurrentControlSet\\Services%" AND (Details LIKE "%\\Users\\%" OR Details LIKE "%\\Temp\\%" OR Details LIKE "%\\AppData\\%" OR Details LIKE "%\\ProgramData\\%"))
   OR
```Branch 3: Sysmon EventCode 11 - File create of system binary name outside Windows```
   (EventCode=11 AND (TargetFilename LIKE "%cmd.exe" OR TargetFilename LIKE "%powershell.exe" OR TargetFilename LIKE "%rundll32.exe" OR TargetFilename LIKE "%regsvr32.exe" OR TargetFilename LIKE "%msiexec.exe") AND NOT match(TargetFilename, "(?i)C:\\Windows\\"))
   OR
```Branch 4: Security EventCode 4688 - Process created from suspicious path matching system binary name```
   (EventCode=4688 AND (match(NewProcessName, "(?i)(\\Users\\|\\Temp\\|\\AppData\\|\\ProgramData\\)")) AND (match(NewProcessName, "(?i)(cmd\.exe|powershell\.exe|rundll32\.exe|regsvr32\.exe|msiexec\.exe|svchost\.exe)$")))
| eval technique=case(
    EventCode=7, "DLL Image Load from User-Writable Path",
    EventCode=13, "Service Registry Path Hijack",
    EventCode=11, "Shadow System Binary File Creation",
    EventCode=4688, "System Binary Name from Non-System Path",
    true(), "Unknown"
  )
| eval score=case(
    EventCode=7, 60,
    EventCode=13, 70,
    EventCode=11, 85,
    EventCode=4688, 80,
    true(), 50
  )
| eval actor=coalesce(User, SubjectUserName, "-")
| eval host=coalesce(ComputerName, host)
| eval detail=coalesce(ImageLoaded, TargetObject, TargetFilename, NewProcessName, "-")
| table _time, host, actor, EventCode, technique, score, detail, Image, ParentImage
| sort - score, - _time
high severity medium confidence

Multi-branch SPL detection across Sysmon and Windows Security logs targeting: DLL image loads (Event 7) from user-writable directories initiated by system processes; registry value sets (Event 13) modifying service image paths to non-standard locations; file creation events (Event 11) for system binary names outside C:\Windows; and process creation events (Event 4688) where a process uses a system binary name but runs from a user-writable directory. Scored by risk.

Data Sources

SysmonWindows Security Event Log

Required Sourcetypes

XmlWinEventLog:Microsoft-Windows-Sysmon/OperationalWinEventLog:Security

False Positives & Tuning

  • Application installers dropping DLLs temporarily into user-writable staging directories during installation routines
  • Developer environments with build output directories prepended to PATH that shadow system binary names
  • Enterprise management tools (SCCM, Ansible, Chef) that modify service registry values as part of legitimate configuration management
  • Penetration testing toolkits (e.g., Metasploit, Cobalt Strike in authorized engagements) that create test binaries in temp paths
  • Portable/containerized applications that bundle their own versions of common executables outside standard installation paths
Download portable Sigma rule (.yml)

Other platforms for T1574

Microsoft Sentinel (KQL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1DLL Search Order Hijack via Missing DLL in System Process Working Directory

    Expected signal: Sysmon Event ID 7 (ImageLoaded) with ImageLoaded path pointing to %TEMP%\wlbsctrl.dll. DeviceImageLoadEvents in MDE with FolderPath matching %TEMP%.

  2. Test 2Service Registry ImagePath Modification to Non-Standard Path

    Expected signal: Sysmon Event ID 13 (RegistryValueSet) for HKLM\SYSTEM\CurrentControlSet\Services\DummyTestSvc\ImagePath with value pointing to %TEMP%. Windows Security Event 4657 if object access auditing is enabled.

  3. Test 3PATH Environment Variable Hijack via User Registry Modification

    Expected signal: Sysmon Event ID 13 (RegistryValueSet) for HKCU\Environment\Path with the new value containing the %TEMP% subdirectory. DeviceRegistryEvents in MDE with RegistryValueData containing \Temp\.

  4. Test 4Linux Dynamic Linker Hijack via LD_PRELOAD

    Expected signal: Linux auditd syscall events for the execve/openat calls loading the malicious .so. Syslog entries if auditd is configured to monitor /tmp. Process events showing LD_PRELOAD environment variable set in process spawn context.

Last updated: 2026-03-19 Research depth: deep
References (12)

Unlock Pro Content

Get the full detection package for T1574 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance
Sign Up for Pro View Pricing

Related Detections

Sub-techniques (12)

Related Techniques

T1574.001DLLT1574.004Dylib HijackingT1574.005Executable Installer File Permissions WeaknessT1574.006Dynamic Linker HijackingT1574.007Path Interception by PATH Environment VariableT1574.008Path Interception by Search Order HijackingT1574.009Path Interception by Unquoted PathT1574.010Services File Permissions WeaknessT1574.011Services Registry Permissions WeaknessT1574.012COR_PROFILERT1574.013KernelCallbackTableT1574.014AppDomainManagerT1055.011Extra Window Memory InjectionT1218.011Rundll32T1037Boot or Logon Initialization ScriptsT1053.005Scheduled Task

Same Tactic: Persistence

Popular Detections