T1574.013 — KernelCallbackTable

Tactics: Stealth, Execution · Platforms: Windows

Adversaries may abuse the KernelCallbackTable of a process to hijack its execution flow in order to run their own payloads. The KernelCallbackTable can be found in the Process Environment Block (PEB) and is initialized to an array of graphic functions available to a GUI process once user32.dll is…

Sub-technique of Hijack Execution Flow (T1574).

Sigma detection rules (1)

T1574.013 Hijack Execution Flow: KernelCallbackTable

title: "T1574.013 Hijack Execution Flow: KernelCallbackTable"
id: a3a5a4c3-8f15-40f5-ab84-7aa2cfbaff67
description: 'Detection Strategy for Hijack Execution Flow through the KernelCallbackTable on Windows — requires a Sysmon ProcessAccess event with a GrantedAccess mask consistent with VM_WRITE/VM_OPERATION. (Data Component: Process Access; baseline tier: windows-eventid.) Tune using: MonitoredProcesses, CallbackFunctions, TimeWindow, AccessMaskThresholds.'
references:
  - https://attack.mitre.org/techniques/T1574/013
author: Shahrukh Khan
date: 2026-04-17
license: MIT
tags:
  - attack.stealth
  - attack.execution
  - attack.t1574.013

logsource:
  category: process_access
  product: windows
  service: sysmon

detection:
  selection:
    EventID: 10
    GrantedAccess:
      - '0x1F3FFF'
      - '0x1FFFFF'
      - '0x1F0FFF'
      - '0x1F1FFF'
      - '0x1F2FFF'
      - '0x1A19FF'
      - '0x1478'
      - '0x1638'
      - '0x0438'

  filter_system_account:
    SourceUser|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and not filter_system_account

falsepositives:
  - Debuggers, EDR agents, and legitimate injection-based accessibility/automation tools opening processes with a similarly broad GrantedAccess mask.

level: medium

Related sub-techniques

Explore