T1574 Hijack Execution Flow
EnterpriseAdversaries may execute their own malicious payloads by hijacking the way operating systems run programs. Hijacking execution flow can be for the purposes of persistence, since this hijacked execution may reoccur over time. Adversaries may also use these mechanisms to elevate privileges or evade defenses, such as application control or other restrictions on execution. There are many ways an adversary may hijack the flow of execution, including by manipulating how the operating system locates programs to be executed. How the operating system locates libraries to be used by a program can also be intercepted. Locations where the operating system looks for programs/resources, such as file directories and in the case of Windows the Registry, could also be poisoned to include malicious payloads.
platforms
Platforms this applies to.
tactics
ATT&CK tactics this technique serves.
sub-techniques (13)
More specific entries beneath this one.
mitigations
ATT&CK mitigations that reduce this.
detected by (6)
Data components that detect this.
NIST CSF 2.0 — areas of relevance (Protect / Detect)
NIST CSF 2.0 areas this most relates to (evidence-ranked).
- PR.DSData Securitymoderate · backed by 7 of 18 mapped controls
- PR.PSPlatform Securitymoderate · backed by 7 of 18 mapped controls
- DE.CMContinuous Monitoringmoderate · backed by 6 of 18 mapped controls
Derived from MITRE CTID (Apache-2.0) and the NIST 800-53 ↔ CSF crosswalk (public domain). Indicative relevance along the Protect/Detect axis — not a compliance assessment or coverage claim.
mitigating controls (18)
Security controls that mitigate this.
known-exploited CVEs (16)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-27363US | high8.1OT critical | KEV | ||
An out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not vulnerable) when attempting to parse font subglyph structures related to Tru… | ||||
| CVE-2024-21762US | critical9.8OT critical | KEV | ||
A out-of-bounds write vulnerability in Fortinet FortiOS 7.4.0 through 7.4.2, FortiOS 7.2.0 through 7.2.6, FortiOS 7.0.0 through 7.0.13, FortiOS 6.4.0 through 6.4.14, FortiOS 6.2.0… | ||||
| CVE-2023-6549US | high7.5OT critical | KEV | ||
Improper Restriction of Operations within the Bounds of a Memory Buffer in NetScaler ADC and NetScaler Gateway allows Unauthenticated Denial of Service and Out-Of-Bounds Memory Rea… | ||||
| CVE-2023-7024US | high8.8OT critical | KEV | ||
Heap buffer overflow in WebRTC in Google Chrome prior to 120.0.6099.129 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security… | ||||
| CVE-2023-4966US | high7.5OT critical | KEV | ||
Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. | ||||
| CVE-2023-5217US | high8.8OT critical | KEV | ||
Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a cra… | ||||
| CVE-2023-3519US | critical9.8OT critical | KEV | ||
Unauthenticated remote code execution | ||||
| CVE-2023-27997US | critical9.8OT critical | KEV | ||
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy… | ||||
| CVE-2022-41328US | high7.1OT critical | KEV | ||
A improper limitation of a pathname to a restricted directory vulnerability ('path traversal') [CWE-22] in Fortinet FortiOS version 7.2.0 through 7.2.3, 7.0.0 through 7.0.9 and bef… | ||||
| CVE-2022-42475US | critical9.8OT critical | KEV | ||
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.0 through 6.2.11, 6.0.15 and earlier an… | ||||
| CVE-2022-41073US | —OT critical | KEV | ||
Windows Print Spooler Elevation of Privilege Vulnerability | ||||
| CVE-2022-3038US | high8.8OT critical | KEV | ||
Use after free in Network Service in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | ||||
| CVE-2022-1040US | critical9.8OT critical | KEV | ||
An authentication bypass vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v18.5 MR3 and older. | ||||
| CVE-2020-5735US | high8.8OT critical | KEV | ||
Amcrest cameras and NVR are vulnerable to a stack-based buffer overflow over port 37777. An authenticated remote attacker can abuse this issue to crash the device and possibly exec… | ||||
| CVE-2017-6742US | high8.8OT critical | KEV | ||
A vulnerability in the SNMP implementation of could allow an authenticated, remote attacker to cause a reload of the affected system or to remotely execute code. An attacker could… | ||||
| CVE-2016-1010US | high8.8OT critical | KEV | ||
Integer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176,… | ||||
software (9)
Malware and tools associated with this.
campaigns (2)
Campaigns that use this.
Detected by (Sigma) (8)
Sigma detection rules related to this.
source
Where this definition is published.