Hijack Execution Flow T1574
Tactics: Stealth, Execution
Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs. Hijacking execution flow can be for the purposes of persistence, since this hijacked execution may reoccur over time. Adversaries may also use these mechanisms to elevate privileges or evade defenses, such as application control or other restrictions on execution.
Events covered
42 catalog events are tagged with this technique by at least one rule.
Authoring guide
These 323 rules share fields, values, and exclusions.
Fields filtered most (115 distinct)
These fields appear most often in rule filters.
Top indicator values (5408 distinct)
These values appear most often in rule predicates.
Exclusions (2301 distinct)
These values appear most often in top-level exclusions.
Rules under this technique
These vendors publish rules tagged with this technique.
Sigma 134 rules
- Abuse of Service Permissions to Hide Services Via Set-Service
- Abuse of Service Permissions to Hide Services Via Set-Service - PS
- APT27 - Emissary Panda Activity
- Aruba Network Service Potential DLL Sideloading
- Changing Existing Service ImagePath Value Via Reg.EXE
- Code Injection by ld.so Preload
- Creation Of Non-Existent System DLL
- Creation of WerFault.exe/Wer.dll in Unusual Folder
- DHCP Callout DLL Installation
- DHCP Server Error Failed Loading the CallOut DLL
- DHCP Server Loaded the CallOut DLL
- Diamond Sleet APT DLL Sideloading Indicators
- DLL Execution Via Register-cimprovider.exe
- DLL Names Used By SVR For GraphicalProton Backdoor
- DLL Search Order Hijackig Via Additional Space in Path
- DLL ServerLevelPluginDll command installation
- DLL ServerLevelPluginDll registration ("serverlevelplugindll" feature abuse)
- DLL ServerLevelPluginDll registration (Reg via Sysmon)
- DLL Sideloading by VMware Xfer Utility
- DLL Sideloading Of ShellChromeAPI.DLL
- DNS Server Error Failed Loading the ServerLevelPluginDLL
- Enabling COR Profiler Environment Variables
- Exploiting SetupComplete.cmd CVE-2019-1378
- Fax Service DLL Search Order Hijack
- HackTool - Powerup Write Hijack DLL
- HackTool - SharpUp PrivEsc Tool Execution
- Lazarus APT DLL Sideloading Activity
- Malicious DLL File Dropped in the Teams or OneDrive Folder
- Microsoft Defender Blocked from Loading Unsigned DLL
- Microsoft Office DLL Sideload
- Mimispool printer driver installation (PrintNightmare vulnerability - CVE-2021-36958)
- Modification of ld.so.preload
- New DNS ServerLevelPluginDll Installed
- New DNS ServerLevelPluginDll Installed Via Dnscmd.EXE
- Pingback Backdoor Activity
- Pingback Backdoor DLL Loading Activity
- Pingback Backdoor File Indicators
- Possible impact of 'SMOKEDHAM backdoor' with MSDTC service privilege escalation via command line
- Possible Privilege Escalation via Weak Service Permissions
- Potential 7za.DLL Sideloading
- Potential Antivirus Software DLL Sideloading
- Potential appverifUI.DLL Sideloading
- Potential AVKkid.DLL Sideloading
- Potential Azure Browser SSO Abuse
- Potential CCleanerDU.DLL Sideloading
- Potential CCleanerReactivator.DLL Sideloading
- Potential Chrome Frame Helper DLL Sideloading
- Potential DLL Sideloading Of DBGCORE.DLL
- Potential DLL Sideloading Of DBGHELP.DLL
- Potential DLL Sideloading Of DbgModel.DLL
- Potential DLL Sideloading Of KeyScramblerIE.DLL Via KeyScrambler.EXE
- Potential DLL Sideloading Of Libcurl.DLL Via GUP.EXE
- Potential DLL Sideloading Of MpSvc.DLL
- Potential DLL Sideloading Of MsCorSvc.DLL
- Potential DLL Sideloading Of Non-Existent DLLs From System Folders
- Potential DLL Sideloading Via ClassicExplorer32.dll
- Potential DLL Sideloading Via comctl32.dll
- Potential DLL Sideloading Via DeviceEnroller.EXE
- Potential DLL Sideloading Via JsSchHlp
- Potential DLL Sideloading Via VMware Xfer
- Potential EACore.DLL Sideloading
- Potential Edputil.DLL Sideloading
- Potential Goopdate.DLL Sideloading
- Potential Initial Access via DLL Search Order Hijacking
- Potential Iviewers.DLL Sideloading
- Potential JLI.dll Side-Loading
- Potential Libvlc.DLL Sideloading
- Potential Mfdetours.DLL Sideloading
- Potential Mpclient.DLL Sideloading
- Potential Mpclient.DLL Sideloading Via Defender Binaries
- Potential Notepad++ CVE-2025-49144 Exploitation
- Potential Persistence Attempt Via Existing Service Tampering
- Potential PlugX Activity
- Potential PrintNightmare Exploitation Attempt
- Potential Privilege Escalation via Service Permissions Weakness
- Potential Python DLL SideLoading
- Potential Raspberry Robin Aclui Dll SideLoading
- Potential Rcdll.DLL Sideloading
- Potential Registry Persistence Attempt Via DbgManagedDebugger
- Potential RjvPlatform.DLL Sideloading From Default Location
- Potential RjvPlatform.DLL Sideloading From Non-Default Location
- Potential RoboForm.DLL Sideloading
- Potential ShellDispatch.DLL Sideloading
- Potential SmadHook.DLL Sideloading
- Potential SolidPDFCreator.DLL Sideloading
- Potential Suspicious Activity Using SeCEdit
- Potential System DLL Sideloading From Non System Locations
- Potential Vcruntime140 DLL Sideloading
- Potential Vivaldi_elf.DLL Sideloading
- Potential Waveedit.DLL Sideloading
- Potential Wazuh Security Platform DLL Sideloading
- Potential WWlib.DLL Sideloading
- Potentially Suspicious Child Process of KeyScrambler.exe
- Registry Modification for OCI DLL Redirection
- Registry-Free Process Scope COR_PROFILER
- Regsvr32 DLL Execution With Uncommon Extension
- Renamed Vmnat.exe Execution
- Service abuse with malicious ImagePath (Reg via command)
- Service DACL Abuse To Hide Services Via Sc.EXE
- Service permissions hijacked for privileges abuse (PowerShell)
- Service permissions hijacked for privileges abuse (reg via command)
- Service permissions hijacked for privileges abuse (Reg via PowerShell)
- Service permissions hijacked for privileges abuse (service)
- Service Registry Key Read Access Request
- Service Registry Permissions Weakness Check
- Service Security Descriptor Tampering Via Sc.EXE
- Setup16.EXE Execution With Custom .Lst File
- Signed DLL Loaded With Missing PE Version Metadata
- Small Sieve Malware CommandLine Indicator
- Spool process spawned a CMD shell (PrintNightmare vulnerability - CVE-2021-36958)
- Suspicious GUP Usage
- Suspicious Printer Driver Empty Manufacturer
- Suspicious Service DACL Modification Via Set-Service Cmdlet - PS
- Suspicious Unsigned Thor Scanner Execution
- System Control Panel Item Loaded From Uncommon Location
- SystemNightmare by GentilKiwi - External printer mapped (CVE-2021-1675 / CVE-2021-34527)
- SystemNightmare by GentilKiwi - New external device added (CVE-2021-1675 / CVE-2021-34527)
- Tasks Folder Evasion
- Third Party Software DLL Sideloading
- Trusted Path Bypass via Windows Directory Spoofing
- UAC Bypass With Fake DLL
- Unsigned .node File Loaded
- Unsigned Binary Loaded From Suspicious Location
- Unsigned Mfdetours.DLL Sideloading
- Unsigned Module Loaded by ClickOnce Application
- Use Of Hidden Paths Or Files
- Using SettingSyncHost.exe as LOLBin
- VMGuestLib DLL Sideload
- VMMap Signed Dbghelp.DLL Potential Sideloading
- VMMap Unsigned Dbghelp.DLL Potential Sideloading
- Windows Spooler Service Suspicious Binary Load
- Winnti Malware HK University Campaign
- Winnti Pipemon Characteristics
- Xwizard.EXE Execution From Non-Default Location
Elastic 146 rules
- APT Package Manager Configuration File Creation
- BindFltApi Loaded by an Unusual Process
- Boot File Copy
- Default Application Hijacking
- DLL Dropped by MSIEXEC followed by SideLoad
- DLL Side Loading of a file dropped by Microsoft Office
- DLL Side Loading via a Copied Microsoft Executable
- DNF Package Manager Plugin File Creation
- DPKG Package Installed by Unusual Parent Process
- Dracut Module Creation
- Dylib Injection via Process Environment Variables
- Dylib Load via SSH-Keygen
- Dylib Loaded by Process in Suspicious Location
- Dynamic Linker (ld.so) Creation
- Dynamic Linker Copy
- Dynamic Linker Creation
- Dynamic Linker Modification Detected via Defend for Containers
- Egress Connection by a DNF Package Manager Descendant
- Egress Connection by a YUM Package Manager Descendant
- Egress Network Connection from Default DPKG Directory
- Egress Network Connection from RPM Package
- Evasion via LdrpKernel32 Overwrite
- Execution via local SxS Shared Module
- Git Hook Child Process
- Git Hook Command Execution
- Git Hook Created or Modified
- Git Hook Egress Network Connection
- GRUB Configuration File Creation
- GRUB Configuration Generation through Built-in Utilities
- Hollow Image Behavior via Native API
- Ingress DLL Transfer followed by DLL SideLoading
- Initramfs Extraction via CPIO
- Initramfs Unpacking via unmkinitramfs
- Known Desktop Application DLL Search Order Hijack
- Launchpad Hijack
- Linux Shared Object Load via SSH-Keygen
- Memory Allocation from a High Entropy Module
- Modification of Dynamic Linker Preload Shared Object
- Modification of Environment Variable via Unsigned or Untrusted Parent
- NetworkManager Dispatcher Script Creation
- Node.js Pre or Post-Install Script Execution
- Oversized DLL Creation followed by SideLoad
- Persistence via DirectoryService Plugin Modification
- Persistence via MSDTC Service Hijack
- Persistence via TelemetryController Scheduled Task Hijack
- Persistence via Update Orchestrator Service Hijack
- Pod or Container Creation with Suspicious Command-Line
- Potential CVE-2025-32463 Nsswitch File Creation
- Potential DLL Hijack via Directory Spoofing
- Potential DLL Hijacking via Environment Paths
- Potential DLL Hollowing from a Writable Image
- Potential DLL Search Order Hijacking of an Existing Program
- Potential DLL Side-Loading via Trusted Microsoft Programs
- Potential DLL SideLoad via a Microsoft Signed Binary
- Potential DLL SideLoad via a Renamed Signed Binary
- Potential Evasion with Hardware Breakpoints
- Potential Exploit via Fake RPC Messages
- Potential Exploitation of an Unquoted Service Path Vulnerability
- Potential Hardware Breakpoints Evasion
- Potential Initial Access via DLL Search Order Hijacking
- Potential Masquerading as System32 DLL
- Potential Persistence via File Modification
- Potential privilege escalation via CVE-2022-38028
- Potential Privilege Escalation via DLL Redirection
- Potential Privilege Escalation via Elevated IFileOperation
- Potential Privilege Escalation via File Redirection
- Potential Privilege Escalation via InstallerFileTakeOver
- Potential Privilege Escalation via Missing DLL
- Potential Privilege Escalation via PKEXEC
- Potential Privilege Escalation via Service ImagePath Modification
- Potential Process Injection via dd
- Potential Protected Process DLL Injection via RPC
- Potential Proxy Execution via Systemd-run
- Potential snap-confine Privilege Escalation via CVE-2026-3888
- Potential Sudo Hijacking
- Potential Suspicious File Edit
- Potential Windows Session Hijacking via CcmExec
- Privilege Escalation via Microsoft Exchange DLL Hijacking
- Privilege Escalation via PKEXEC Exploitation
- Privilege Escalation via Windir Environment Variable
- Privilege Escalation via Windir or SystemRoot Environment Variable
- Process Anti-Debug via Memory Patching
- Protected Process from Unusual Parent
- Protected Process Light Bypass via DLL Tampering
- Python Path File (pth) Creation
- Python Site or User Customize File Creation
- RPM Package Installed by Unusual Parent Process
- Self Injection via AppDomain Manager Assembly
- Shared Object Created by Previously Unknown Process
- Shared Object File Creation and Immediate Preload
- Shared Object Injection via Process Environment Variable
- Shared Object Load via LoLBin
- Shellcode Execution from Low Reputation Module
- Signed Binary Execution via Microsoft Office
- Signed Proxy Execution via MS Work Folders
- Stack Spoofing via ROP Gadget for DLL Load
- Suspicious Antimalware Scan Interface DLL
- Suspicious AppDomain Manager Configuration File
- Suspicious APT Package Manager Execution
- Suspicious APT Package Manager Network Connection
- Suspicious BindFilterPort Client Process
- Suspicious DLL Loaded for Persistence or Privilege Escalation
- Suspicious Dynamic Linker Discovery via od
- Suspicious Echo or Printf Execution Detected via Defend for Containers
- Suspicious Image Load by System Protected Process
- Suspicious Kworker UID Elevation
- Suspicious Microsoft Antimalware Service Execution
- Suspicious Network Connection via systemd
- Suspicious Path Invocation from Command Line
- Suspicious Print Spooler Point and Print DLL
- Suspicious Python Path Configuration File (.pth) Creation
- Suspicious Registry Symbolic Link
- Suspicious Remote Process Thread Access
- Suspicious Symbolic Link Created
- Suspicious Unsigned DLL Loaded by a Trusted Process
- System Binary Symlink to Suspicious Location
- UAC Bypass Attempt via CDSSync Scheduled Task Hijack
- UAC Bypass Attempt via Consent DLL Search Order Hijacking
- UAC Bypass Attempt via DCCW DLL Search Order Hijacking
- UAC Bypass Attempt via DismCore DLL Side-Loading
- UAC Bypass Attempt via DLL Side-Loading from Windows Media Player Folder
- UAC Bypass Attempt via MMC DLL Search Order Hijacking
- UAC Bypass Attempt via Privileged IFileOperation COM Interface
- UAC Bypass Attempt via SilentCleanup Task DLL Search Order Hijacking
- UAC Bypass Attempt via WOW64 Logger DLL Side-Loading
- UAC Bypass via Hijacking WinMgmt MMC
- UAC Bypass via Windows Firewall Snap-In Hijack
- UID Elevation from Previously Unknown Executable
- Unsigned DLL Loaded by a Trusted Process
- Unsigned DLL Loaded by an Elastic Signed Binary
- Unsigned DLL Loaded by Svchost
- Unsigned DLL Loaded from Fake Windows Directory
- Unsigned DLL Side-Loading from a Suspicious Folder
- Untrusted DLL Loaded by a Persistent Program
- Untrusted DLL Loaded by a System Windows Process
- Untrusted DLL Loaded by Azure AD Connect Authentication Agent
- Unusual DPKG Execution
- Unusual Dylib Load from Users Shared Directory
- Unusual LD_PRELOAD/LD_LIBRARY_PATH Command Line Arguments
- Unusual Persistence via Services Registry
- Unusual Preload Environment Variable Process Execution
- Unusual Process Modifying GenAI Configuration File
- Unusual Process Running as Antimalware Protected
- VirtualAlloc API Call from an Unsigned DLL
- WPS Office Exploitation via DLL Hijack
- Yum Package Manager Plugin File Creation
Splunk 37 rules
- Detect Path Interception By Creation Of program exe
- GitHub Workflow File Creation or Modification
- iphlpapi.dll File Write to Appdata_Local_Microsoft (Sysmon)
- Linux Auditd Preload Hijack Library Calls
- Linux Auditd Preload Hijack Via Preload File
- Linux Possible Privilege Escalation via PYTHONPATH
- Linux Preload Hijack Library Calls
- MSI Module Loaded by Non-System Binary
- Msmpeng Application DLL Side Loading
- Python PYTHONPATH Modification During Package Installation
- Reg exe Manipulating Windows Services Registry Keys
- Shai-Hulud Workflow File Creation or Modification
- Windows BitDefender Submission Wizard DLL Sideloading
- Windows DLL Search Order Hijacking Hunt with Sysmon
- Windows DLL Search Order Hijacking with iscsicpl
- Windows DLL Side-Loading In Calc
- Windows DLL Side-Loading Process Child Of Calc
- Windows Get-Variable.EXE Execution from WindowsApps Folder
- Windows Hijack Execution Flow Version Dll Side Load
- Windows Known Abused DLL Created
- Windows Known Abused DLL Loaded Suspiciously
- Windows Known GraphicalProton Loaded Modules
- Windows Masquerading Explorer As Child Process
- Windows Mock Trusted Directory MSC File Creation
- Windows Mustang Panda USB Tool Execution
- Windows Phantom DLL Created on Disk
- Windows Potential AppDomainManager Hijack Artifacts Creation
- Windows PowerShell Module File Created
- Windows Rundll32 Execution With Log.DLL
- Windows SCCM Adsource DLL Was Planted In SMS Provider Directory
- Windows SCCM Smsexec Spawned a Suspicious Child Process
- Windows Service Creation Using Registry Entry
- Windows Set Custom DNS ServerLevelPlugin Via Dnscmd
- Windows SqlWriter SQLDumper DLL Sideload
- Windows Unsigned DLL Side-Loading
- Windows Unsigned DLL Side-Loading In Same Process Path
- Windows Unsigned MS DLL Side-Loading
Kusto 6 rules
- COM Registry Key Modified to Point to File in Color Profile Folder
- Dataverse - TI map URL to DataverseActivity
- Detect Suspicious Commands Initiated by Webserver Processes
- DLL Hijacking: Loading from an Unusual Directory
- Hijack Execution Flow - DLL Side-Loading
- Powershell Empire Cmdlets Executed in Command Line