T1574 · Hijack Execution Flow

Sunturai

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice

T1574 · Hijack Execution Flow · Sunturai

attack-patternenterprise-attackT1574

Hijack Execution Flow

attack-pattern--aedfca76-3b30-4866-b2aa-0f1d7fd1e4b6

Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs. Hijacking execution flow can be for the purposes of persistence, since this hijacked execution may reoccur over time. Adversaries may also use these mechanisms to elevate privileges or evade defenses, such as application control or other restrictions on execution. There are many ways an adversary may hijack the flow of execution, including by manipulating how the operating system locates programs to be executed. How the operating system locates libraries to be used by a program can also be intercepted. Locations where the operating system looks for programs/resources, such as file directories and in the case of Windows the Registry, could also be poisoned to include malicious payloads.

Created: Mar 12, 2020, 8:38 PM UTC
Modified: May 12, 2026, 3:12 PM UTC

12 sub-techniques under this technique

Each is its own technique in the catalogue, with its own detections.

93 published detections cover this technique

Every one carries the source it came from and the licence it was published under.

Detections covering this technique
Detection	Severity	Source	Published	Licence
Unusual Process Modifying GenAI Configuration File	Medium	Elastic detection rules	Oct 8, 2026	Elastic License 2.0
Shared Object Created by Previously Unknown Process	Medium	Elastic detection rules	Oct 6, 2026	Elastic License 2.0
Node.js Pre or Post-Install Script Execution	Medium	Elastic detection rules	Sep 29, 2026	Elastic License 2.0
Potential Exploitation of an Unquoted Service Path Vulnerability	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
UAC Bypass Attempt via Privileged IFileOperation COM Interface	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Privilege Escalation via Windir Environment Variable	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Potential Privilege Escalation via Service ImagePath Modification	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Suspicious Print Spooler Point and Print DLL	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Suspicious DLL Loaded for Persistence or Privilege Escalation	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Potential Privilege Escalation via InstallerFileTakeOver	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Potential privilege escalation via CVE-2022-38028	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Persistence via Update Orchestrator Service Hijack	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Persistence via TelemetryController Scheduled Task Hijack	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Unusual Persistence via Services Registry	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Unsigned DLL Loaded by Svchost	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Execution via local SxS Shared Module	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
WPS Office Exploitation via DLL Hijack	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Signed Proxy Execution via MS Work Folders	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Unsigned DLL Side-Loading from a Suspicious Folder	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Potential Windows Session Hijacking via CcmExec	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Potential Masquerading as System32 DLL	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Suspicious Microsoft Antimalware Service Execution	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Potential DLL Side-Loading via Trusted Microsoft Programs	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Suspicious Antimalware Scan Interface DLL	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Untrusted DLL Loaded by Azure AD Connect Authentication Agent	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0

Showing 25 of 93

Filter in the catalogue

External references

mitre-attackT1574Open reference

Platforms

LinuxmacOSWindows

Kill chain phases

executionstealth

Relationships

Incoming and outgoing edges in the selected ATT&CK release.

Incoming and outgoing edges in the selected ATT&CK release
Direction	Type	Related object