Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in User Guide
Log in Get started
Detection Strategies DET0038 — Detection Strategy for Hijack Execution Flow using Executable Installer File Permissions Weakness
DET0038

Detection Strategy for Hijack Execution Flow using Executable Installer File Permissions Weakness

1 analytic(s) · 1 technique(s) detected

Analytics

1
AN0108 Analytic 0108
Windows

Executables written or modified in installer directories (e.g., %TEMP% subdirectories or Program Files installer paths) followed by execution under elevated context. Defender observes abnormal file replacement activity, process creation by installer processes pointing to attacker-supplied binaries, and unexpected module loads in elevated processes.

WinEventLog:Sysmon EventCode=11 WinEventLog:Sysmon EventCode=15 WinEventLog:Sysmon EventCode=1 WinEventLog:Sysmon EventCode=7
[MonitoredDirectories] Specific writable directories to monitor (e.g., %TEMP%, C:\ProgramData, installer unpack paths).
[HashBaseline] Known good hashes of installer binaries to detect replacement.
[TimeWindow] Correlation interval between file overwrite and execution event.
[UserContext] Differentiate expected admin-installer execution vs. anomalous user writes.

Details

MITRE ID
DET0038
STIX ID
x-mitre-detection-strategy--07b1eb42-4f7b-4420-972e-2f28f17c0fa0
Analytics
1
Techniques Detected
1
By Tactic
Stealth
1
Leaving Threaticon

This link opens an external site that isn't part of the platform.