T1574.005 — Executable Installer File Permissions Weakness

Tactics: Stealth, Execution · Platforms: Windows

Adversaries may execute their own malicious payloads by hijacking the binaries used by an installer. These processes may automatically execute specific binaries as part of their functionality or to perform other actions. If the permissions on the file system directory containing a target binary,…

Sub-technique of Hijack Execution Flow (T1574).

Sigma detection rules (1)

T1574.005 Hijack Execution Flow: Executable Installer File Permissions Weakness

title: "T1574.005 Hijack Execution Flow: Executable Installer File Permissions Weakness"
id: 7b17ac89-7df5-44d1-b2bc-3c4ab3d550a5
description: 'Detection Strategy for Hijack Execution Flow using Executable Installer File Permissions Weakness. (Data Component: File Creation; baseline tier: windows-eventid.) Tune using: MonitoredDirectories, HashBaseline, TimeWindow, UserContext.'
references:
  - https://attack.mitre.org/techniques/T1574/005
author: Shahrukh Khan
date: 2026-02-12
license: MIT
tags:
  - attack.stealth
  - attack.execution
  - attack.t1574.005

logsource:
  category: file_event
  product: windows
  service: sysmon

detection:
  selection:
    EventID: 11
    Image|endswith:
      - '\msiexec.exe'
      - '\InstallUtil.exe'
    TargetFilename|contains:
      - '\AppData\Local\Temp\'
      - '\Windows\Temp\'
      - '\ProgramData\'
    TargetFilename|endswith:
      - '.exe'
      - '.msi'
      - '.dll'

  condition: selection

falsepositives:
  - Legitimate installer packages routinely stage executables/DLLs in %TEMP% or %ProgramData% before invoking them.

level: medium

Related sub-techniques

Explore