T1574.007 Path Interception by PATH Environment Variable — Detection Rules

Source-backed rule directory

• Trusted Path Bypass via Windows Directory Spoofing · experimental · high · {"category":"image_load","product":"windows"}
• Potential Suspicious Activity Using SeCEdit · test · medium · {"category":"process_creation","product":"windows"}

Atlas deterministic concepts

No exact concept selected.

Anomaly models

No exact Atlas model in this snapshot.

ATT&CK analytic guidance

DET0004 Detection Strategy for Hijack Execution Flow using Path Interception by PATH Environment Variable.

AN0009 Analytic 0009

Abnormal modification of the PATH environment variable or registry keys controlling system paths, combined with execution of binaries named after legitimate system tools from user-writable directories. Defender correlates registry modifications, file creation of suspicious binaries, and process execution paths inconsistent with baseline system directories.

AN0010 Analytic 0010

User modification of the $PATH environment variable in shell configuration files or direct runtime PATH changes, followed by execution of binaries from user-controlled directories. Defender observes file edits to ~/.bashrc, ~/.profile, or /etc/paths.d and process execution resolving to unexpected binary locations.

AN0011 Analytic 0011

Modification of PATH or HOME environment variables through shell config files, launchctl, or /etc/paths.d entries, combined with process execution from attacker-controlled directories. Defender correlates file changes in /etc/paths.d with process execution resolving to malicious binaries.