aol.pm

Hijack Execution Flow

Technique · ATTACK:enterprise:T1574

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:enterprise:T1574",
  "title": "Hijack Execution Flow",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1574",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--aedfca76-3b30-4866-b2aa-0f1d7fd1e4b6",
  "external_id": "T1574",
  "domain": "enterprise",
  "created": "2020-03-12T20:38:12.465Z",
  "modified": "2026-09-02T18:05:12.296Z",
  "version": "2.1",
  "aliases": [

  ],
  "tactics": [
    "stealth",
    "execution"
  ],
  "source_references": [
    {
      "source_name": "Execution flow hijack attempt",
      "url": "https://docs.prismacloud.io/admin-guide/runtime-defense/incident-types/execution-flow-hijack-attempt"
    }
  ]
}

Explicit source assertions (33)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S1111 → uses → ATTACK:enterprise:T1574

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1bb9c007-9110-45c8-9d86-b6c20d408308

Ensilo Darkgate 2018

ATTACK:enterprise:M1052 → mitigates → ATTACK:enterprise:T1574

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--214e4329-960c-4c25-8620-b9573a6e06dc

Executable Installers are Vulnerable

ATTACK:enterprise:T1574.010 → subtechnique-of → ATTACK:enterprise:T1574

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--27660798-1099-4bc7-9496-2b07de076f67

ATTACK:enterprise:S0567 → uses → ATTACK:enterprise:T1574

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--28291398-1281-404e-9603-8aae5a5a9919

CyberBit Dtrack

ATTACK:enterprise:S9024 → uses → ATTACK:enterprise:T1574

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3270c057-e0ee-4a0c-a503-cad4782b6dc2

Google UNC5221 Ivanti January 2025 · Google UNC5221 BRICKSTORM SPAWNCHIMERA April 2024

ATTACK:enterprise:M1040 → mitigates → ATTACK:enterprise:T1574

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--39acd21f-8be0-4116-9449-09d1f4dd91fd

ATTACK:enterprise:T1574.013 → subtechnique-of → ATTACK:enterprise:T1574

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3f403d71-cb42-4f08-a0f3-ea6956d35dcb

ATTACK:enterprise:M1044 → mitigates → ATTACK:enterprise:T1574

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--46eeb6fa-2dcb-4c86-b79e-8891b2e72566

Microsoft More information about DLL · Microsoft Dynamic Link Library Search Order

ATTACK:enterprise:M1047 → mitigates → ATTACK:enterprise:T1574

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4cc78773-df9f-40d8-a2e5-eb2eadb05409

Vulnerability and Exploit Detector · Microsoft CreateProcess · Microsoft Dynamic-Link Library Security · Powersploit

ATTACK:enterprise:M1013 → mitigates → ATTACK:enterprise:T1574

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4f806196-7c20-4923-ae01-8f0f7f27a4a7

FireEye DLL Side-Loading

ATTACK:enterprise:M1018 → mitigates → ATTACK:enterprise:T1574

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--523ef32d-7463-4774-a473-fcccb5b0dadd

ATTACK:enterprise:S0444 → uses → ATTACK:enterprise:T1574

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--58238854-4649-4cea-a43d-aae442dc60a6

FOX-IT May 2016 Mofang

ATTACK:enterprise:S1130 → uses → ATTACK:enterprise:T1574

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--59720c1c-115a-4206-aaa0-42ec4b03f6eb

TrendMicro RaspberryRobin 2022

ATTACK:enterprise:M1051 → mitigates → ATTACK:enterprise:T1574

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--62c9a1c7-557e-433b-b422-3427a308f34e

ATTACK:enterprise:C0036 → uses → ATTACK:enterprise:T1574

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6baa6db4-7ecc-4e98-83cc-5e38c95917f1

Elastic Pikabot 2024

ATTACK:enterprise:T1574.007 → subtechnique-of → ATTACK:enterprise:T1574

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6c99a74d-8a17-453b-9100-ebb3cca33faa

ATTACK:enterprise:M1038 → mitigates → ATTACK:enterprise:T1574

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6fa01dcb-e06c-4f8b-b6a2-c301f0198df4

ATTACK:enterprise:S0354 → uses → ATTACK:enterprise:T1574

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--70ed2026-90af-4236-8180-2c095bbce0fe

Cybereason Cobalt Kitty 2017

ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1574

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7253ab74-8fbb-422b-bf37-258981865b87

ATTACK:enterprise:S1147 → uses → ATTACK:enterprise:T1574

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--75b9ee03-bb9d-49a9-97e4-1979ff6ecbbf

Symantec Daggerfly 2024

ATTACK:enterprise:T1574.005 → subtechnique-of → ATTACK:enterprise:T1574

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7cd00d93-860b-4138-98fc-162cb56a78dd

ATTACK:enterprise:C0017 → uses → ATTACK:enterprise:T1574

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--84f6c3c2-8758-4179-98ca-74e9f726fe7d

Mandiant APT41

ATTACK:enterprise:M1024 → mitigates → ATTACK:enterprise:T1574

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--85422378-e9d7-4bd2-8b57-73fba0641448

ATTACK:enterprise:S1105 → uses → ATTACK:enterprise:T1574

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a2165d87-3372-4d1d-b622-9705a4eb9b41

NCSC-NL COATHANGER Feb 2024

ATTACK:enterprise:T1574.009 → subtechnique-of → ATTACK:enterprise:T1574

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a6f0c9d2-ae40-4dee-9231-4f6fa3d87b00

ATTACK:enterprise:T1574.004 → subtechnique-of → ATTACK:enterprise:T1574

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bced764f-e4f1-43d0-af3b-ae93d607041a

ATTACK:enterprise:T1574.006 → subtechnique-of → ATTACK:enterprise:T1574

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c5589abe-78a2-4d41-8926-33aa3fc3337b

ATTACK:enterprise:T1574.014 → subtechnique-of → ATTACK:enterprise:T1574

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cb197e40-0c4d-403f-b385-8ca378461de9

ATTACK:enterprise:T1574.001 → subtechnique-of → ATTACK:enterprise:T1574

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ccdff6e8-75ea-4386-ab0f-435ac35ccc61

ATTACK:enterprise:T1574.008 → subtechnique-of → ATTACK:enterprise:T1574

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d0e5d834-338b-4c5f-968a-f9f477bc7b9f

ATTACK:enterprise:S1018 → uses → ATTACK:enterprise:T1574

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--def2b383-6cea-4c69-ada2-b3e0e58c43e5

Palo Alto Unit 42 OutSteel SaintBot February 2022

ATTACK:enterprise:T1574.011 → subtechnique-of → ATTACK:enterprise:T1574

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--def869f4-7564-4a09-8f49-59cb696b660d

ATTACK:enterprise:T1574.012 → subtechnique-of → ATTACK:enterprise:T1574

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fc787de3-8a82-43f6-b649-f01a7006be54

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.