T1574.007 — Path Interception by PATH Environment Variable

Tactics: Stealth, Execution · Platforms: Linux, macOS, Windows

Adversaries may execute their own malicious payloads by hijacking environment variables used to load libraries. The PATH environment variable contains a list of directories (User and System) that the OS searches sequentially through in search of the binary that was called from a script or the…

Sub-technique of Hijack Execution Flow (T1574).

Sigma detection rules (3)

T1574.007 Hijack Execution Flow: Path Interception by PATH Environment Variable

title: "T1574.007 Hijack Execution Flow: Path Interception by PATH Environment Variable"
id: d4285689-dc1b-403e-8364-974745f350a5
description: 'Detects creation of files named after common system binaries (net.exe, cmd.exe, rundll32.exe, etc.) outside their legitimate System32/SysWOW64/WinSxS/Program Files directories, a proxy for PATH-hijacking where a malicious binary is planted earlier in the PATH search order. (Data Component: File Creation.) Tune using: MonitoredBinaryNames, TrustedDirectories, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1574/007
author: Shahrukh Khan
date: 2026-02-10
license: MIT
tags:
  - attack.stealth
  - attack.execution
  - attack.t1574.007

logsource:
  category: file_event
  product: windows

detection:
  selection:
    EventID: 11
    TargetFilename|endswith:
      - '\net.exe'
      - '\net1.exe'
      - '\cmd.exe'
      - '\ipconfig.exe'
      - '\systeminfo.exe'
      - '\rundll32.exe'
      - '\reg.exe'
      - '\python.exe'
      - '\java.exe'

  filter_legit_system_path:
    TargetFilename|contains:
      - ':\Windows\System32\'
      - ':\Windows\SysWOW64\'
      - ':\Windows\WinSxS\'
      - ':\Program Files\'
      - ':\Program Files (x86)\'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and not 1 of filter_*

falsepositives:
  - Legitimate installers placing same-named utility binaries in application directories on the PATH; tune TrustedDirectories per environment.

level: medium

T1574.007 Hijack Execution Flow: Path Interception by PATH Environment Variable

title: "T1574.007 Hijack Execution Flow: Path Interception by PATH Environment Variable"
id: 8fc4f7d6-d7cd-4924-88a2-27b704e11748
description: 'Detects shell one-liners (bash/sh/dash -c) that write a PATH= reassignment referencing a world-writable directory (/tmp, /dev/shm, /var/tmp) into a shell profile file (.bashrc, .bash_profile, .profile, /etc/profile), which is the actual PATH-hijack behavior. Replaces the prior version, which alerted on any touch of a shell profile file regardless of content and produced no discrimination from routine profile edits. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: MonitoredShellConfigs, AllowedUserBins.'
references:
  - https://attack.mitre.org/techniques/T1574/007
author: Shahrukh Khan
date: 2026-02-03
license: MIT
tags:
  - attack.stealth
  - attack.execution
  - attack.t1574.007

logsource:
  category: process_creation
  product: linux

detection:
  selection_shell:
    type: EXECVE
    a0|endswith:
      - '/bash'
      - '/sh'
      - '/dash'
    a1: '-c'
  selection_pathvar:
    a2|contains: 'PATH='
  selection_writable_dir:
    a2|contains:
      - '/tmp'
      - '/dev/shm'
      - '/var/tmp'
  selection_profile_file:
    a2|contains:
      - '.bashrc'
      - '.bash_profile'
      - '.profile'
      - '/etc/profile'
      - '.bash_login'

  condition: selection_shell and selection_pathvar and selection_writable_dir and selection_profile_file

falsepositives:
  - Administrators legitimately adding a local bin directory to PATH via a one-line shell command that happens to also mention /tmp in an unrelated argument; scope MonitoredShellConfigs/AllowedUserBins to known-good directories.

level: high

T1574.007 Hijack Execution Flow: Path Interception by PATH Environment Variable

title: "T1574.007 Hijack Execution Flow: Path Interception by PATH Environment Variable"
id: 287e07ae-eb4f-4907-b0cf-7e8819a02871
description: 'Detection Strategy for Hijack Execution Flow using Path Interception by PATH Environment Variable.. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: WatchedPathsDirs, TrustedExecutables.'
references:
  - https://attack.mitre.org/techniques/T1574/007
author: Shahrukh Khan
date: 2026-06-05
license: MIT
tags:
  - attack.stealth
  - attack.execution
  - attack.t1574.007

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|startswith:
      - '/tmp/'
      - '/private/tmp/'
      - '/Users/Shared/'
    Image|endswith:
      - '/ls'
      - '/cp'
      - '/sudo'
      - '/curl'

  condition: selection

falsepositives:
  - Rare legitimate testing scenarios where a developer intentionally builds a same-named binary in a scratch directory for unit testing.

level: high

Related sub-techniques

Explore