T1574.008 — Path Interception by Search Order Hijacking

Tactics: Stealth, Execution · Platforms: Windows

Adversaries may execute their own malicious payloads by hijacking the search order used to load other programs. Because some programs do not call other programs using the full path, adversaries may place their own file in the directory where the calling program is located, causing the operating…

Sub-technique of Hijack Execution Flow (T1574).

Sigma detection rules (1)

T1574.008 Hijack Execution Flow: Path Interception by Search Order Hijacking

title: "T1574.008 Hijack Execution Flow: Path Interception by Search Order Hijacking"
id: f27886d9-1862-434c-bc44-ba85571ed78c
description: 'Detection Strategy for Hijack Execution Flow using Path Interception by Search Order Hijacking. (Retargeted from the original process_creation label to file_event.) Tune using: SuspiciousBinaryList, MonitoredDirectories, TimeWindow, ParentProcessBaseline.'
references:
  - https://attack.mitre.org/techniques/T1574/008
author: Shahrukh Khan
date: 2026-03-20
license: MIT
tags:
  - attack.stealth
  - attack.execution
  - attack.t1574.008

logsource:
  category: file_event
  product: windows
  service: sysmon

detection:
  selection:
    TargetFilename|endswith:
      - '\cmd.exe'
      - '\notepad.exe'
      - '\explorer.exe'
      - '\svchost.exe'
      - '\rundll32.exe'
      - '\conhost.exe'
      - '\taskhostw.exe'

  filter_legit_dirs:
    TargetFilename|contains:
      - '\Windows\System32\'
      - '\Windows\SysWOW64\'
      - '\Windows\WinSxS\'

  condition: selection and not filter_legit_dirs

falsepositives:
  - Legitimate applications that bundle a private, similarly-named copy of a common binary inside their own install directory (rare).

level: medium

Related sub-techniques

Explore