Hijack Execution Flow
Where this stands
A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.
Every analytic in this brief describes a named child's mechanism, and nothing parent-level survives once each is attributed. AN0609 (Windows) is three separate children stacked together: 'modifications to service binary paths, registry keys' is T1574.011 Services Registry Permissions Weakness against the ImagePath value, and its service-creation twin is T1543.003, already published in this corpus; 'processes loading libraries from abnormal paths' is T1574.001, also already published in this corpus against the identical image_load / windows logsource, so a parent rule over Sysmon EventID 7 would be that rule re-tagged attack.t1574. AN0610 (Linux) names /etc/ld.so.preload, which is T1574.006 Dynamic Linker Hijacking, plus 'replacement of service binaries', which is T1543.002 Systemd Service. […]
Covered instead by T1574.001, T1574.004, T1574.006, T1574.011, T1543.002, T1543.003, T1543.001.
What the technique is
Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs. Hijacking execution flow can be for the purposes of persistence, since this hijacked execution may reoccur over time. Adversaries may also use these mechanisms to elevate privileges or evade defenses, such as application control or other restrictions on execution. There are many ways an adversary may hijack the flow of execution, including by manipulating how the operating system locates programs to be executed. How the operating system locates libraries to be used by a program can also be intercepted. Locations where the operating system looks for programs/resources, such as file directories and in the case of Windows the Registry, could also be poisoned to include malicious payloads.
Read it on attack.mitre.orgWhat MITRE says you would watch
- AN0609
Unusual modifications to service binary paths, registry keys, or DLL load paths resulting in alternate execution flow. Defender observes registry key modifications, suspicious file writes into system directories, and processes loading libraries from abnormal paths.
- AN0610
Adversary manipulation of shared library paths, environment variables, or replacement of service binaries. Defender observes suspicious modifications in /etc/ld.so.preload, service config changes, or file writes replacing existing executables.
- AN0611
Abuse of DYLD_INSERT_LIBRARIES or hijacking framework paths for malicious libraries. Defender observes processes invoking abnormal dylibs, modified plist files, or persistence entries pointing to altered binaries.
Technique names and descriptions © MITRE ATT&CK®, CC BY 4.0. Not endorsed by MITRE.