Threat intelligence / Technique

Hijack Execution Flow

Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs. Hijacking execution flow can be for the purposes of persistence, since this hijacked execution may reoccur over time. Adversaries may also use these mechanisms to elevate privileges or evade defenses, such as application control or other restrictions on execution. There are many ways an adversary may hijack the flow of execution, including by manipulating how the operating system locates programs to be executed. How the operating system locates libraries to be used by a program can also be intercepted. Locations where the operating system looks for programs/resources, such as file directories and in the case of Windows the Registry, could also be poisoned to include malicious payloads.

Technique

TypeTechnique

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs. Hijacking execution flow can be for the purposes of persistence, since this hijacked execution may reoccur over time. Adversaries may also use these mechanisms to elevate privileges or evade defenses, such as application control or other restrictions on execution. There are many ways an adversary may hijack the flow of execution, including by manipulating how the operating system locates programs to be executed. How the operating system locates libraries to be used by a program can also be intercepted. Locations where the operating system looks for programs/resources, such as file directories and in the case of Windows the Registry, could also be poisoned to include malicious payloads.

34 recorded

Relationships

mitigates

from Application Developer Guidance

Mitigation

mitigates

from Audit

Mitigation

mitigates

from Behavior Prevention on Endpoint

Mitigation

mitigates

from Execution Prevention

Mitigation

mitigates

from Restrict File and Directory Permissions

Mitigation

mitigates

from Restrict Library Loading

Mitigation

mitigates

from Restrict Registry Permissions

Mitigation

mitigates

from Update Software

Mitigation

mitigates

from User Account Control

Mitigation

mitigates

from User Account Management

Mitigation

subtechnique-of

from AppDomainManager

Technique

subtechnique-of

from COR_PROFILER

Technique

subtechnique-of

from DLL

Technique

subtechnique-of

from DLL Side-Loading

Technique

subtechnique-of

from Dylib Hijacking

Technique

subtechnique-of

from Dynamic Linker Hijacking

Technique

subtechnique-of

from Executable Installer File Permissions Weakness

Technique

subtechnique-of

from KernelCallbackTable

Technique

subtechnique-of

from Path Interception by PATH Environment Variable

Technique

subtechnique-of

from Path Interception by Search Order Hijacking

Technique

subtechnique-of

from Path Interception by Unquoted Path

Technique

subtechnique-of

from Services File Permissions Weakness

Technique

subtechnique-of

from Services Registry Permissions Weakness

Technique

uses

from C0017

Campaign

uses

from COATHANGER

Malware

uses

Malware

uses

from Denis

Malware

uses

Malware

uses

Malware

uses

from Pikabot Distribution February 2024

Campaign

uses

from Raspberry Robin

Malware

uses

Malware

uses

Malware

uses

from SPAWNCHIMERA

Malware

1 external

References

mitre-attack

T1574