T1574 Hijack Execution Flow — Attack Simulation

DC0039 collection page — Scope Sysmon FileCreate (11) to the lab directory; retain the process and file path. Differentiate creation/overwrite if the sensor can.

Providers and collection configuration

• Microsoft Sysmon: Windows event-based collection; enable the event types needed below.
• Linux Audit: Linux alternative for supported system-call and file events; different semantics and fields.
• Apple Endpoint Security clients: macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.

• On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.
• Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.
• For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms.

Required normalized fields: process_id, path, action, size_bytes.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0039",
  "collector": "illustrative-lab-collector",
  "observation": {
    "process_id": 4200,
    "path": "C:\\Lab\\demo.txt",
    "action": "create",
    "size_bytes": 64
  }
}

Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.

DC0061 collection page — Use file-integrity monitoring or scoped OS file-write auditing for general changes. Sysmon 2 records creation-time changes; it is not a general file-write event.

Providers and collection configuration

• Microsoft Sysmon: Windows event-based collection; enable the event types needed below.
• Linux Audit: Linux alternative for supported system-call and file events; different semantics and fields.
• Apple Endpoint Security clients: macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.

• On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.
• Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.
• For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms.

Required normalized fields: path, attribute, before, after.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0061",
  "collector": "illustrative-lab-collector",
  "observation": {
    "path": "C:\\Lab\\demo.txt",
    "attribute": "content_hash",
    "before": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
    "after": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
  }
}

Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.

DC0016 collection page — Scope Sysmon ImageLoad (7) to lab processes/paths; retain module hash, signer and destination process. Inventory alone does not prove a module loaded.

Providers and collection configuration

• Microsoft Sysmon: Windows event-based collection; enable the event types needed below.
• Linux Audit: Linux alternative for supported system-call and file events; different semantics and fields.
• Apple Endpoint Security clients: macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.

• On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.
• Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.
• For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms.

Required normalized fields: process_id, image_loaded, signed, action.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0016",
  "collector": "illustrative-lab-collector",
  "observation": {
    "process_id": 4200,
    "image_loaded": "C:\\Lab\\demo.dll",
    "signed": false,
    "action": "load"
  }
}

Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.

DC0032 collection page — Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.

Providers and collection configuration

• Microsoft Sysmon: Windows event-based collection; enable the event types needed below.
• Linux Audit: Linux alternative for supported system-call and file events; different semantics and fields.
• Apple Endpoint Security clients: macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.

• On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.
• Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.
• For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms.

Required normalized fields: process_guid, image, parent_image, command_line, user.

<EventFiltering>
  <ProcessCreate onmatch="include">
    <Image condition="is">C:\Windows\System32\whoami.exe</Image>
  </ProcessCreate>
</EventFiltering>

This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0032",
  "collector": "illustrative-lab-collector",
  "observation": {
    "process_guid": "lab-process-001",
    "image": "C:\\Windows\\System32\\whoami.exe",
    "parent_image": "C:\\Windows\\System32\\cmd.exe",
    "command_line": "whoami",
    "user": "LAB\\analyst"
  }
}

Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.

DC0041 collection page — Inventory service name, executable, startup mode, owner and status using supported OS APIs; compare successive snapshots.

Providers and collection configuration

• osquery: Scheduled host-state queries; supported tables and privileges vary by OS. Select a table that actually exposes the required object.
• Linux Audit plus inventory snapshots: Events explain changes; snapshots describe state at collection time.

• Define the inventory query, allowed host set, interval and least-privileged reader. Store a stable asset ID, observation time and collector version.
• Keep successive snapshots and calculate additions, removals and changed attributes. Pair state changes with audit events when available.
• Export collector health and missed-poll counts so a missing snapshot is not misclassified as a missing asset.

Required normalized fields: service, executable, start_mode, state.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0041",
  "collector": "illustrative-lab-collector",
  "observation": {
    "service": "LabService",
    "executable": "C:\\Lab\\service.exe",
    "start_mode": "manual",
    "state": "stopped"
  }
}

Visibility limits: Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.

DC0063 collection page — Use RegistryEvent 13 for value-set and 14 for rename; compare against intended policy and keep original type/value where available.

Providers and collection configuration

• Microsoft Sysmon: Windows event-based collection; enable the event types needed below.

• On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.
• Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.
• Keep this Windows-specific source separate from other operating systems; there is no direct cross-platform event-ID equivalence.

Required normalized fields: registry_path, event_type, value_type, value.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0063",
  "collector": "illustrative-lab-collector",
  "observation": {
    "registry_path": "HKCU\\Software\\Lab\\Mode",
    "event_type": "SetValue",
    "value_type": "DWORD",
    "value": 1
  }
}

Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.

MITRE detection strategy

5 exact-tagged source rules. A source tag is a discovery aid, not a relevance verdict. Check the observation point and actual condition of each rule.

• Potential Initial Access via DLL Search Order Hijacking — test; product: windows; category: file_event.
• DLL Execution Via Register-cimprovider.exe — test; category: process_creation; product: windows.
• Regsvr32 DLL Execution With Uncommon Extension — test; category: process_creation; product: windows.
• Potential Registry Persistence Attempt Via DbgManagedDebugger — test; category: registry_set; product: windows.
• Suspicious Printer Driver Empty Manufacturer — test; category: registry_set; product: windows.

• S0354 Denis — malware.

  Denis replaces the nonexistent Windows DLL "msfte.dll" with its own malicious version, which is loaded by the SearchIndexer.exe and SearchProtocolHost.exe.[Cybereason Cobalt Kitty 2017]

  Exact relationship: relationship--70ed2026-90af-4236-8180-2c095bbce0fe
• S0444 ShimRat — malware.

  ShimRat can hijack the cryptbase.dll within migwiz.exe to escalate privileges and bypass UAC controls.[FOX-IT May 2016 Mofang]

  Exact relationship: relationship--58238854-4649-4cea-a43d-aae442dc60a6
• S0567 Dtrack — malware.

  One of Dtrack can replace the normal flow of a program execution with malicious code.[CyberBit Dtrack]

  Exact relationship: relationship--28291398-1281-404e-9603-8aae5a5a9919
• S1018 Saint Bot — malware.

  Saint Bot will use the malicious file <code>slideshow.mp4</code> if present to load the core API provided by <code>ntdll.dll</code> to avoid any hooks placed on calls to the original <code>ntdll.dll</code> file by endpoint detection and response or antimalware software.[Palo Alto Unit 42 OutSteel SaintBot February 2022 ]

  Exact relationship: relationship--def2b383-6cea-4c69-ada2-b3e0e58c43e5
• S1105 COATHANGER — malware.

  COATHANGER will remove and write malicious shared objects associated with legitimate system functions such as `read(2)`.[NCSC-NL COATHANGER Feb 2024]

  Exact relationship: relationship--a2165d87-3372-4d1d-b622-9705a4eb9b41
• S1111 DarkGate — malware.

  DarkGate edits the Registry key <code>HKCU\Software\Classes\mscfile\shell\open\command</code> to execute a malicious AutoIt script.[Ensilo Darkgate 2018] When eventvwr.exe is executed, this will call the Microsoft Management Console (mmc.exe), which in turn references the modified Registry key.

  Exact relationship: relationship--1bb9c007-9110-45c8-9d86-b6c20d408308
• S1130 Raspberry Robin — malware.

  Raspberry Robin will drop a copy of itself to a subfolder in <code>%Program Data%</code> or <code>%Program Data%\\Microsoft\\</code> to attempt privilege elevation and defense evasion if not running in Session 0.[TrendMicro RaspberryRobin 2022]

  Exact relationship: relationship--59720c1c-115a-4206-aaa0-42ec4b03f6eb
• S1147 Nightdoor — malware.

  Nightdoor uses a legitimate executable to load a malicious DLL file for installation.[Symantec Daggerfly 2024]

  Exact relationship: relationship--75b9ee03-bb9d-49a9-97e4-1979ff6ecbbf
• S9024 SPAWNCHIMERA — malware.

  SPAWNCHIMERA can persist across system upgrades by hijacking the execution flow of dspkginstall, a binary used during the system upgrade process.[Google UNC5221 Ivanti January 2025][Google UNC5221 BRICKSTORM SPAWNCHIMERA April 2024]

  Exact relationship: relationship--3270c057-e0ee-4a0c-a503-cad4782b6dc2

• M1013 Application Developer Guidance

  When possible, include hash values in manifest files to help prevent side-loading of malicious libraries.[FireEye DLL Side-Loading]

• M1018 User Account Management

  Limit privileges of user accounts and groups so that only authorized administrators can interact with service changes and service binary target path locations. Deny execution from user directories such as file download directories and temp directories where able.

  Ensure that proper permissions and directory access control are set to deny users the ability to write files to the top-level directory <code>C:</code> and system directories, such as <code>C:\Windows\</code>, to reduce places where malicious files could be placed for execution.

• M1022 Restrict File and Directory Permissions

  Install software in write-protected locations. Set directory access controls to prevent file writes to the search paths for applications, both in the folders where applications are run from and the standard library folders.

• M1024 Restrict Registry Permissions

  Ensure proper permissions are set for Registry hives to prevent users from modifying keys for system components that may lead to privilege escalation.

• M1038 Execution Prevention

  Adversaries may use new payloads to execute this technique. Identify and block potentially malicious software executed through hijacking by using application control solutions also capable of blocking libraries loaded by legitimate software.

• M1040 Behavior Prevention on Endpoint

  Some endpoint security solutions can be configured to block some types of behaviors related to process injection/memory tampering based on common sequences of indicators (ex: execution of specific API functions).

• M1044 Restrict Library Loading

  Disallow loading of remote DLLs. This is included by default in Windows Server 2012+ and is available by patch for XP+ and Server 2003+.

  Enable Safe DLL Search Mode to force search for system DLLs in directories with greater restrictions (e.g. <code>%SYSTEMROOT%</code>)to be used before local directory DLLs (e.g. a user's home directory)

  The Safe DLL Search Mode can be enabled via Group Policy at Computer Configuration > [Policies] > Administrative Templates > MSS (Legacy): MSS: (SafeDllSearchMode) Enable Safe DLL search mode. The associated Windows Registry key for this is located at <code>HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\SafeDLLSearchMode</code>[Microsoft More information about DLL][Microsoft Dynamic Link Library Search Order]

• M1047 Audit

  Use auditing tools capable of detecting hijacking opportunities on systems within an enterprise and correct them. Toolkits like the PowerSploit framework contain PowerUp modules that can be used to explore systems for hijacking weaknesses.[Powersploit]

  Use the program sxstrace.exe that is included with Windows along with manual inspection to check manifest files for side-loading vulnerabilities in software.

  Find and eliminate path interception weaknesses in program configuration files, scripts, the PATH environment variable, services, and in shortcuts by surrounding PATH variables with quotation marks when functions allow for them. Be aware of the search order Windows uses for executing or loading binaries and use fully qualified paths wherever appropriate.

  Clean up old Windows Registry keys when software is uninstalled to avoid keys with no associated legitimate binaries. Periodically search for and correct or report path interception weaknesses on systems that may have been introduced using custom or available tools that report software using insecure path configurations.[Microsoft CreateProcess][Microsoft Dynamic-Link Library Security][Vulnerability and Exploit Detector]

• M1051 Update Software

  Update software regularly to include patches that fix DLL side-loading vulnerabilities.

• M1052 User Account Control

  Turn off UAC's privilege elevation for standard users <code>[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]</code> to automatically deny elevation requests, add: <code>"ConsentPromptBehaviorUser"=dword:00000000</code>. Consider enabling installer detection for all users by adding: <code>"EnableInstallerDetection"=dword:00000001</code>. This will prompt for a password for installation and also log the attempt. To disable installer detection, instead add: <code>"EnableInstallerDetection"=dword:00000000</code>. This may prevent potential elevation of privileges through exploitation during the process of UAC detecting the installer, but will allow the installation process to continue without being logged. [Executable Installers are Vulnerable]