Techniques › T1574 › AN0609
AN0609 Analytic 0609
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Unusual modifications to service binary paths, registry keys, or DLL load paths resulting in alternate execution flow. Defender observes registry key modifications, suspicious file writes into system directories, and processes loading libraries from abnormal paths.</p>
- Detects
- T1574 Hijack Execution Flow
- Part of
- DET0218 Detection Strategy for Hijack Execution Flow across OS platforms.
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Sysmon | EventCode=1 | DC0032 Process Creation |
| WinEventLog:Sysmon | EventCode=7 | DC0016 Module Load |
| WinEventLog:Security | EventCode=4657 | DC0063 Windows Registry Key Modification |
| WinEventLog:Sysmon | EventCode=11 | DC0039 File Creation |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
ServiceBaseline | Expected registry keys and service paths for comparison. |
AllowedDllPaths | Directories considered valid for DLL loading. |
TimeWindow | Correlation interval between registry/file modification and process execution. |
KEV CVEs whose mapped technique this analytic detects
| CVE | Vendor / product | State |
|---|---|---|
| CVE-2016-1010 | Adobe Flash Player and AIR | Mapped |
| CVE-2017-6742 | Cisco IOS and IOS XE Software | Mapped |
| CVE-2020-5735 | Amcrest Cameras and Network Video Recorder (NVR) | Mapped |
| CVE-2022-1040 | Sophos Firewall | Mapped |
| CVE-2022-3038 | Google Chromium Network Service | Mapped |
| CVE-2022-41073 | Microsoft Windows | Mapped |
| CVE-2022-41328 | Fortinet FortiOS | Mapped |
| CVE-2022-42475 | Fortinet FortiOS | Mapped |
| CVE-2023-27997 | Fortinet FortiOS and FortiProxy SSL-VPN | Mapped |
| CVE-2023-3519 | Citrix NetScaler ADC and NetScaler Gateway | Mapped |
| CVE-2023-4966 | Citrix NetScaler ADC and NetScaler Gateway | Mapped |
| CVE-2023-5217 | Google Chromium libvpx | Mapped |
| CVE-2023-6549 | Citrix NetScaler ADC and NetScaler Gateway | Mapped |
| CVE-2023-7024 | Google Chromium WebRTC | Mapped |
| CVE-2024-21762 | Fortinet FortiOS | Mapped |
| CVE-2025-27363 | FreeType FreeType | Mapped |