T1574 — Hijack Execution Flow

# T1574 - Hijack Execution Flow

## SOC Recommendation
Investigate Hijack Execution Flow activity in the context of Stealth/Execution: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.

## D3FEND Mappings
| D3FEND Technique | Relationship | Practical SOC Action |
|---|---|---|
| File Analysis | Detect | Monitor for File Analysis indicators relevant to this technique. |
| File Encryption | Harden | Apply File Encryption to reduce this technique's viability before an incident occurs. |
| File Eviction | Evict | Use File Eviction to remove the adversary's foothold once this technique is confirmed. |
| Content Filtering | Isolate | Apply Content Filtering to contain the blast radius once this technique is observed. |

## Investigation Steps
1. Review Defender for Endpoint / Defender XDR alerts and timeline for the affected host or identity.
2. Check Sentinel analytics rules and incidents correlated with this technique.
3. Review Entra ID sign-in and audit logs if the technique involves an identity or cloud resource.

## Evidence to Collect
- Host or resource affected
- Account or identity involved
- Timestamp of the activity
- Related process, file, or network artifact
- Any preceding or follow-on alerts

## Response Actions
| Action | Risk | Automation Safe | Approval Required |
|---|---|---|---|
| Quarantine the malicious DLL | Low | No | Yes |
| Block SHA256 in MDE custom indicators | Medium | No | Yes |
| If loaded by a widely-deployed application: check all other | Low | Yes | No |

## KQL
```kql
DeviceImageLoadEvents
| where TimeGenerated >= ago(5m)
| where not(InitiatingProcessFolderPath has_any ("windows\\system32", "windows\\syswow64", "program files"))
| where FileName endswith ".dll"
| where not(FolderPath has_any ("windows\\system32", "windows\\syswow64", "program files", "winsxs"))
| where isnotempty(SHA1)
| where IsSigned == false
| where InitiatingProcessFileName !in~ ("MsMpEng.exe", "SenseCE.exe")
| project
    TimeGenerated,
    DeviceName,
    AccountName,
    InitiatingProcessFileName,
    InitiatingProcessFolderPath,
    FileName,
    FolderPath,
    SHA256,
    IsSigned
| extend timestamp = TimeGenerated,
         HostCustomEntity = DeviceName,
         AccountCustomEntity = AccountName
| order by TimeGenerated desc
```
```kql
// Suspicious commands launched by web server processes
DeviceProcessEvents 
| where (((InitiatingProcessParentFileName in("w3wp.exe", "beasvc.exe",
    "httpd.exe") or InitiatingProcessParentFileName startswith "tomcat")
    or InitiatingProcessFileName in("w3wp.exe", "beasvc.exe", "httpd.exe") or
    InitiatingProcessFileName startswith "tomcat"))
    and FileName in~('cmd.exe', 'powershell.exe')
| where ProcessCommandLine contains '%temp%'
    or ProcessCommandLine has 'wget'
    or ProcessCommandLine has 'whoami'
    or ProcessCommandLine has 'certutil'
    or ProcessCommandLine has 'systeminfo'
    or ProcessCommandLine has 'ping'
    or ProcessCommandLine has 'ipconfig'
    or ProcessCommandLine has 'timeout'
| summarize
    take_any(FileName),
    make_set(ProcessCommandLine, 100000),
    take_any(InitiatingProcessFileName),
    take_any(InitiatingProcessParentFileName)
    by DeviceId, DeviceName
| extend HostName = iff(DeviceName has '.', substring(DeviceName, 0, indexof(DeviceName, '.')), DeviceName)
| extend DnsDomain = iff(DeviceName has '.', substring(DeviceName, indexof(DeviceName, '.') + 1), "")
```
```kql
let guids = dynamic(["{ddc05a5a-351a-4e06-8eaf-54ec1bc2dcea}","{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}","{4590f811-1d3a-11d0-891f-00aa004b2e24}", "{4de225bf-cf59-4cfc-85f7-68b90f185355}", "{F56F6FDD-AA9D-4618-A949-C1B91AF43B1A}"]);
  let mde_data = DeviceRegistryEvents
  | where ActionType =~ "RegistryValueSet"
  | where RegistryKey contains "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID"
  | where RegistryKey has_any (guids)
  | where RegistryValueData has "System32\\spool\\drivers\\color";
  let event_data = SecurityEvent
  | where EventID == 4657
  | where ObjectName contains "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID"
  | where ObjectName has_any (guids)
  | where NewValue has "System32\\spool\\drivers\\color"
  | extend RegistryKey = ObjectName, RegistryValueData = NewValue, DeviceName=Computer, InitiatingProcessFileName = Process, InitiatingProcessAccountName=SubjectUserName, InitiatingProcessAccountDomain = SubjectDomainName;
  union mde_data, event_data
  | extend HostName = tostring(split(DeviceName, ".")[0]), DomainIndex = toint(indexof(DeviceName, '.'))
  | extend HostNameDomain = iff(DomainIndex != -1, substring(DeviceName, DomainIndex + 1), DeviceName)
```

## Escalation Criteria
- Hijack Execution Flow activity observed on a privileged account or critical system.
- Activity follows or precedes other suspicious behaviour in the same investigation.
- Automated triage cannot confidently rule out malicious intent.

## False Positive Considerations
- Legitimate administrative or maintenance activity matching this pattern.
- Approved security testing or red team exercise.
- Known benign software producing similar telemetry.

Generated by SOC Response Atlas by Basyrix.

Want to push this directly to Confluence? Upgrade to Basyrix Pro.

• /api/techniques/T1574.json
• /api/recommendations/T1574.json
• /api/d3fend/T1574.json
• /api/mappings/T1574.json
• /api/confluence/T1574.md

Example curl:

curl https://atlas.basyrix.com/api/recommendations/T1574.json

Response:

{
  "technique_id": "T1574",
  "name": "Hijack Execution Flow",
  "priority": "high",
  "status": "complete",
  "version": "0.1.0",
  "last_reviewed": "2026-07-23",
  "generated_by": "SOC Response Atlas by Basyrix",
  "tactics": [
    "Stealth",
    "Execution"
  ],
  "platforms": [
    "Linux",
    "macOS",
    "Windows"
  ],
  "summary": "Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs. Hijacking execution flow can be for the purposes of persistence, since this hijacked execution may reoccur over time. Adversaries may also use these mechanisms to elevate privileges or evade defenses, such as application control or other restrictions on execution...",
  "soc_recommendation": "Investigate Hijack Execution Flow activity in the context of Stealth/Execution: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.",
  "d3fend_mappings": [
    {
      "id": "D3-FA",
      "name": "File Analysis",
      "relationship": "detect",
      "practical_action": "Monitor for File Analysis indicators relevant to this technique.",
      "tooling": [
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-FE",
      "name": "File Encryption",
      "relationship": "harden",
      "practical_action": "Apply File Encryption to reduce this technique's viability before an incident occurs.",
      "tooling": [
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-FEV",
      "name": "File Eviction",
      "relationship": "evict",
      "practical_action": "Use File Eviction to remove the adversary's foothold once this technique is confirmed.",
      "tooling": [
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-CF",
      "name": "Content Filtering",
      "relationship": "isolate",
      "practical_action": "Apply Content Filtering to contain the blast radius once this technique is observed.",
      "tooling": [
        "Defender for Endpoint"
      ]
    }
  ],
  "investigation_steps": {
    "microsoft": [
      "Review Defender for Endpoint / Defender XDR alerts and timeline for the affected host or identity.",
      "Check Sentinel analytics rules and incidents correlated with this technique.",
      "Review Entra ID sign-in and audit logs if the technique involves an identity or cloud resource."
    ],
    "generic": [
      "Confirm whether the observed hijack execution flow activity matches expected administrative or application behaviour.",
      "Identify the host, account, or resource where the activity occurred and its business criticality.",
      "Check for related alerts before and after this activity to reconstruct the broader intrusion timeline.",
      "Real detection reference: \"DLL Side-Loading\" -- Flags an unsigned DLL loaded from a non-standard path by a legitimate process running outside system/program directories, consistent with DLL side-loading."
    ]
  },
  "evidence_to_collect": [
    "Host or resource affected",
    "Account or identity involved",
    "Timestamp of the activity",
    "Related process, file, or network artifact",
    "Any preceding or follow-on alerts"
  ],
  "response_actions": [
    {
      "name": "Quarantine the malicious DLL",
      "category": "Response",
      "risk": "Low",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide"
    },
    {
      "name": "Block SHA256 in MDE custom indicators",
      "category": "Response",
      "risk": "Medium",
      "automation_safe": false,
      "approval_required": true,
      "tool": "Defender for Endpoint"
    },
    {
      "name": "If loaded by a widely-deployed application: check all other",
      "category": "Response",
      "risk": "Low",
      "automation_safe": true,
      "approval_required": false,
      "tool": "See investigation guide",
      "notes": "If loaded by a widely-deployed application: check all other instances of that app"
    }
  ],
  "queries": {
    "kql": [
      {
        "name": "GEN-DE-005 — DLL Side-Loading",
        "description": "Flags an unsigned DLL loaded from a non-standard path by a legitimate process running outside system/program directories, consistent with DLL side-loading. (Source: Bell Integration baseline detection library, mapped via sub-technique T1574.002.)",
        "query": "DeviceImageLoadEvents\n| where TimeGenerated >= ago(5m)\n| where not(InitiatingProcessFolderPath has_any (\"windows\\\\system32\", \"windows\\\\syswow64\", \"program files\"))\n| where FileName endswith \".dll\"\n| where not(FolderPath has_any (\"windows\\\\system32\", \"windows\\\\syswow64\", \"program files\", \"winsxs\"))\n| where isnotempty(SHA1)\n| where IsSigned == false\n| where InitiatingProcessFileName !in~ (\"MsMpEng.exe\", \"SenseCE.exe\")\n| project\n    TimeGenerated,\n    DeviceName,\n    AccountName,\n    InitiatingProcessFileName,\n    InitiatingProcessFolderPath,\n    FileName,\n    FolderPath,\n    SHA256,\n    IsSigned\n| extend timestamp = TimeGenerated,\n         HostCustomEntity = DeviceName,\n         AccountCustomEntity = AccountName\n| order by TimeGenerated desc"
      },
      {
        "name": "fa2f7d8a-6726-465a-aa72-6f6e3d4c99d7 — Detect Suspicious Commands Initiated by Webserver Processes",
        "description": "This query was originally published in the threat analytics report, Operation Soft Cell. Operation Soft Cell is a series of campaigns targeting users' call logs at telecommunications providers throughout the world. These attacks date from as early as 2012. Operation Soft Cell operators sometimes use legitimate web server processes to launch commands, especially for network discovery and user/owner discovery. The following query detects activity of this kind. Reference - https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)",
        "query": "// Suspicious commands launched by web server processes\nDeviceProcessEvents \n| where (((InitiatingProcessParentFileName in(\"w3wp.exe\", \"beasvc.exe\",\n    \"httpd.exe\") or InitiatingProcessParentFileName startswith \"tomcat\")\n    or InitiatingProcessFileName in(\"w3wp.exe\", \"beasvc.exe\", \"httpd.exe\") or\n    InitiatingProcessFileName startswith \"tomcat\"))\n    and FileName in~('cmd.exe', 'powershell.exe')\n| where ProcessCommandLine contains '%temp%'\n    or ProcessCommandLine has 'wget'\n    or ProcessCommandLine has 'whoami'\n    or ProcessCommandLine has 'certutil'\n    or ProcessCommandLine has 'systeminfo'\n    or ProcessCommandLine has 'ping'\n    or ProcessCommandLine has 'ipconfig'\n    or ProcessCommandLine has 'timeout'\n| summarize\n    take_any(FileName),\n    make_set(ProcessCommandLine, 100000),\n    take_any(InitiatingProcessFileName),\n    take_any(InitiatingProcessParentFileName)\n    by DeviceId, DeviceName\n| extend HostName = iff(DeviceName has '.', substring(DeviceName, 0, indexof(DeviceName, '.')), DeviceName)\n| extend DnsDomain = iff(DeviceName has '.', substring(DeviceName, indexof(DeviceName, '.') + 1), \"\")"
      },
      {
        "name": "ed8c9153-6f7a-4602-97b4-48c336b299e1 — COM Registry Key Modified to Point to File in Color Profile Folder",
        "description": "This query looks for changes to COM registry keys to point to files in C:\\Windows\\System32\\spool\\drivers\\color\\. This can be used to enable COM hijacking for persistence. Ref: https://www.microsoft.com/security/blog/2022/07/27/untangling-knotweed-european-private-sector-offensive-actor-using-0-day-exploits/' (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)",
        "query": "let guids = dynamic([\"{ddc05a5a-351a-4e06-8eaf-54ec1bc2dcea}\",\"{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\",\"{4590f811-1d3a-11d0-891f-00aa004b2e24}\", \"{4de225bf-cf59-4cfc-85f7-68b90f185355}\", \"{F56F6FDD-AA9D-4618-A949-C1B91AF43B1A}\"]);\n  let mde_data = DeviceRegistryEvents\n  | where ActionType =~ \"RegistryValueSet\"\n  | where RegistryKey contains \"HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Classes\\\\CLSID\"\n  | where RegistryKey has_any (guids)\n  | where RegistryValueData has \"System32\\\\spool\\\\drivers\\\\color\";\n  let event_data = SecurityEvent\n  | where EventID == 4657\n  | where ObjectName contains \"HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Classes\\\\CLSID\"\n  | where ObjectName has_any (guids)\n  | where NewValue has \"System32\\\\spool\\\\drivers\\\\color\"\n  | extend RegistryKey = ObjectName, RegistryValueData = NewValue, DeviceName=Computer, InitiatingProcessFileName = Process, InitiatingProcessAccountName=SubjectUserName, InitiatingProcessAccountDomain = SubjectDomainName;\n  union mde_data, event_data\n  | extend HostName = tostring(split(DeviceName, \".\")[0]), DomainIndex = toint(indexof(DeviceName, '.'))\n  | extend HostNameDomain = iff(DomainIndex != -1, substring(DeviceName, DomainIndex + 1), DeviceName)"
      }
    ],
    "spl": [],
    "esql": [
      {
        "name": "342f834b-21a6-41bf-878c-87d116eba3ee — Dynamic Linker Modification Detected via Defend for Containers",
        "description": "(EQL) This rule detects the creation or modification of the dynamic linker preload shared object (ld.so.preload) inside a container. The Linux dynamic linker is used to load libraries needed by a program at runtime. Adversaries may hijack the dynamic linker by modifying the /etc/ld.so.preload file to point to malicious libraries... (Source: Elastic's official detection-rules repository (Elastic License v2).)",
        "query": "file where host.os.type == \"linux\" and event.type != \"deletion\" and\nfile.path like (\"/etc/ld.so.preload\", \"/etc/ld.so.conf.d/*\", \"/etc/ld.so.conf\") and\nprocess.interactive == true and container.id like \"*\""
      },
      {
        "name": "d9bfa475-270d-4b07-93cb-b1f49abe13da — Suspicious Echo or Printf Execution Detected via Defend for Containers",
        "description": "(EQL) This rule detects the execution of the echo/printf command to write data to potential persistence files, decode base64/32/16 and hex content or establish connections to a potential C2. The echo/printf commands are used to display a line of text or write data to a file... (Source: Elastic's official detection-rules repository (Elastic License v2).)",
        "query": "process where event.type == \"start\" and event.action == \"exec\" and process.interactive == true and\nprocess.name in (\"bash\", \"dash\", \"sh\", \"tcsh\", \"csh\", \"zsh\", \"ksh\", \"fish\") and\nprocess.args in (\"-lc\", \"-c\", \"-cl\") and process.args like (\"*echo *\", \"*printf *\") and\nprocess.args like (\n  \"*/etc/cron*\", \"*/etc/rc.local*\", \"*/dev/tcp/*\", \"*/etc/init.d*\", \"*/etc/update-motd.d*\",\n  \"*/etc/ld.so*\", \"*/etc/sudoers*\", \"*base64 *\", \"*base32 *\", \"*base16 *\", \"*/etc/profile*\",\n  \"*/dev/shm/*\", \"*/etc/ssh*\", \"*/home/*/.ssh/*\", \"*/root/.ssh*\" , \"*~/.ssh/*\", \"*xxd *\",\n  \"*/etc/shadow*\", \"* /tmp/*\", \"* /var/tmp/*\", \"* /dev/shm/* \", \"* ~/*\", \"* /home/*\",\n  \"* /run/*\", \"* /var/run/*\", \"*|*sh\", \"*|*python*\", \"*|*php*\", \"*|*perl*\", \"*|*busybox*\",\n  \"*/var/www/*\", \"*>*\", \"*;*\", \"*chmod *\", \"*rm *\", \"*openssl enc*\"\n) and container.id like \"?*\""
      }
    ]
  },
  "automation": {
    "safe": [
      "Add recommendation as Sentinel incident comment.",
      "Run enrichment queries.",
      "Create ServiceNow SecOps task."
    ],
    "approval_required": [
      "Contain or disable the affected host/account.",
      "Any change to production configuration."
    ]
  },
  "escalation_criteria": [
    "Hijack Execution Flow activity observed on a privileged account or critical system.",
    "Activity follows or precedes other suspicious behaviour in the same investigation.",
    "Automated triage cannot confidently rule out malicious intent."
  ],
  "false_positive_considerations": [
    "Legitimate administrative or maintenance activity matching this pattern.",
    "Approved security testing or red team exercise.",
    "Known benign software producing similar telemetry."
  ],
  "confluence": {
    "title": "T1574 - Hijack Execution Flow Response Guidance",
    "labels": [
      "mitre",
      "attack",
      "d3fend",
      "secops",
      "basyrix"
    ],
    "sections": [
      "summary",
      "d3fend_mappings",
      "investigation_steps",
      "response_actions",
      "queries",
      "automation",
      "escalation_criteria",
      "false_positive_considerations"
    ]
  }
}