T1574 Hijack Execution Flow
EnterpriseAdversaries may execute their own malicious payloads by hijacking the way operating systems run programs. Hijacking execution flow can be for the purposes of persistence, since this hijacked execution may reoccur over time. Adversaries may also use these mechanisms to elevate privileges or evade defenses, such as application control or other restrictions on execution. There are many ways an adversary may hijack the flow of execution, including by manipulating how the operating system locates programs to be executed. How the operating system locates libraries to be used by a program can also be intercepted. Locations where the operating system looks for programs/resources, such as file directories and in the case of Windows the Registry, could also be poisoned to include malicious payloads.
Plattformen
Plattformen, für die dies gilt.
Taktiken
ATT&CK-Taktiken, denen diese Technik dient.
Untertechniken (13)
Spezifischere Einträge unterhalb dieses.
Gegenmaßnahmen
ATT&CK-Gegenmaßnahmen, die dies verringern.
Erkannt durch (6)
Datenkomponenten, die dies erkennen.
NIST CSF 2.0 — Relevanzbereiche (Protect / Detect)
NIST-CSF-2.0-Bereiche mit dem größten Bezug (belegbasiert).
- PR.DSData Securitymoderat · gestützt durch 7 von 18 zugeordneten Controls
- PR.PSPlatform Securitymoderat · gestützt durch 7 von 18 zugeordneten Controls
- DE.CMContinuous Monitoringmoderat · gestützt durch 6 von 18 zugeordneten Controls
Abgeleitet aus MITRE CTID (Apache-2.0) und dem NIST-800-53-↔-CSF-Crosswalk (gemeinfrei). Eine indikative Relevanz entlang der Protect-/Detect-Achse — keine Compliance-Bewertung und keine Abdeckungsaussage.
Mindernde Maßnahmen (18)
Sicherheitskontrollen, die dies mindern.
bekannt ausgenutzte CVEs (16)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2025-27363US | high8.1OT kritisch | KEV | ||
An out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not vulnerable) when attempting to parse font subglyph structures related to Tru… | ||||
| CVE-2024-21762US | critical9.8OT kritisch | KEV | ||
A out-of-bounds write vulnerability in Fortinet FortiOS 7.4.0 through 7.4.2, FortiOS 7.2.0 through 7.2.6, FortiOS 7.0.0 through 7.0.13, FortiOS 6.4.0 through 6.4.14, FortiOS 6.2.0… | ||||
| CVE-2023-6549US | high7.5OT kritisch | KEV | ||
Improper Restriction of Operations within the Bounds of a Memory Buffer in NetScaler ADC and NetScaler Gateway allows Unauthenticated Denial of Service and Out-Of-Bounds Memory Rea… | ||||
| CVE-2023-7024US | high8.8OT kritisch | KEV | ||
Heap buffer overflow in WebRTC in Google Chrome prior to 120.0.6099.129 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security… | ||||
| CVE-2023-4966US | high7.5OT kritisch | KEV | ||
Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. | ||||
| CVE-2023-5217US | high8.8OT kritisch | KEV | ||
Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a cra… | ||||
| CVE-2023-3519US | critical9.8OT kritisch | KEV | ||
Unauthenticated remote code execution | ||||
| CVE-2023-27997US | critical9.8OT kritisch | KEV | ||
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy… | ||||
| CVE-2022-41328US | high7.1OT kritisch | KEV | ||
A improper limitation of a pathname to a restricted directory vulnerability ('path traversal') [CWE-22] in Fortinet FortiOS version 7.2.0 through 7.2.3, 7.0.0 through 7.0.9 and bef… | ||||
| CVE-2022-42475US | critical9.8OT kritisch | KEV | ||
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.0 through 6.2.11, 6.0.15 and earlier an… | ||||
| CVE-2022-41073US | —OT kritisch | KEV | ||
Windows Print Spooler Elevation of Privilege Vulnerability | ||||
| CVE-2022-3038US | high8.8OT kritisch | KEV | ||
Use after free in Network Service in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | ||||
| CVE-2022-1040US | critical9.8OT kritisch | KEV | ||
An authentication bypass vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v18.5 MR3 and older. | ||||
| CVE-2020-5735US | high8.8OT kritisch | KEV | ||
Amcrest cameras and NVR are vulnerable to a stack-based buffer overflow over port 37777. An authenticated remote attacker can abuse this issue to crash the device and possibly exec… | ||||
| CVE-2017-6742US | high8.8OT kritisch | KEV | ||
A vulnerability in the SNMP implementation of could allow an authenticated, remote attacker to cause a reload of the affected system or to remotely execute code. An attacker could… | ||||
| CVE-2016-1010US | high8.8OT kritisch | KEV | ||
Integer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176,… | ||||
Software (9)
Zugehörige Malware und Tools.
Kampagnen (2)
Kampagnen, die dies verwenden.
Erkannt durch (Sigma) (8)
Zugehörige Sigma-Erkennungsregeln.
Quelle
Wo diese Definition veröffentlicht ist.