T1574 Hijack Execution Flow

Technique: T1574
Tactics: Defense Evasion, Execution
Research, 90 days: 1
KEV CVEs mapped: 16
SigmaHQ rules: 8
Elastic, Splunk: 78
thrunt rules: 0
Upstream: https://attack.mitre.org/techniques/T1574

MITRE description

Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs. Hijacking execution flow can be for the purposes of persistence, since this hijacked execution may reoccur over time. Adversaries may also use these mechanisms to elevate privileges or evade defenses, such as application control or other restrictions on execution. There are many ways an adversary may hijack the flow of execution, including by manipulating how the operating system locates programs to be executed. How the operating system locates libraries to be used by a program can also be intercepted. Locations where the operating system looks for programs/resources, such as file directories and in the case of Windows the Registry, could also be poisoned to include malicious payloads.(Citation: Execution flow hijack attempt)

KEV CVEs mapped to this technique

MITRE CTID maps these KEV CVEs to this technique by hand. They are the actively exploited vulnerabilities behind this technique's KEV signal.

Research citing this technique

Reports and advisories from the last 90 days that cite this technique.

2026-08-13 Recorded Future Insikt: Malware Crypting Services and the Threat Actors Who Sell Them

Detection coverage

SigmaHQ community rules

Exploiting SetupComplete.cmd CVE-2019-1378 (emerging-threats)
Potential PrintNightmare Exploitation Attempt (emerging-threats)
Windows Spooler Service Suspicious Binary Load (emerging-threats)
Potential Initial Access via DLL Search Order Hijacking (core)
DLL Execution Via Register-cimprovider.exe (core)
Regsvr32 DLL Execution With Uncommon Extension (core)
Potential Registry Persistence Attempt Via DbgManagedDebugger (core)
Suspicious Printer Driver Empty Manufacturer (core)

Elastic and Splunk rules

Unusual Process Modifying GenAI Configuration File (elastic)
Node.js Pre or Post-Install Script Execution (elastic)
Dynamic Linker Modification Detected via Defend for Containers (elastic)
Suspicious Echo or Printf Execution Detected via Defend for Containers (elastic)
Potential Persistence via File Modification (elastic)
Dynamic Linker Creation (elastic)
Unusual LD_PRELOAD/LD_LIBRARY_PATH Command Line Arguments (elastic)
Dynamic Linker (ld.so) Creation (elastic)
Shared Object Load via LoLBin (elastic)
Potential Proxy Execution via Systemd-run (elastic)
System Binary Symlink to Suspicious Location (elastic)
Unusual Preload Environment Variable Process Execution (elastic)
Suspicious Dynamic Linker Discovery via od (elastic)
Pod or Container Creation with Suspicious Command-Line (elastic)
Suspicious Path Invocation from Command Line (elastic)
Suspicious APT Package Manager Execution (elastic)
APT Package Manager Configuration File Creation (elastic)
Suspicious APT Package Manager Network Connection (elastic)
Boot File Copy (elastic)
DNF Package Manager Plugin File Creation (elastic)
DPKG Package Installed by Unusual Parent Process (elastic)
Unusual DPKG Execution (elastic)
Dracut Module Creation (elastic)
Dynamic Linker Copy (elastic)
Initramfs Extraction via CPIO (elastic)

Showing 25 of 78.

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) at release r2026-07-01 plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.