Hijack Execution Flow
Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs. Hijacking execution flow can be for the purposes of persistence, since this hijacked execution may reoccur over time. Adversaries may also use these mechanisms to elevate privileges or evade defenses, such as application control or other restrictions on execution. There are many ways an adversary may hijack the flow of execution, including by manipulating how the operating system locates pr...
BY SOURCE
PROCEDURES (48)
Auto-extracted: 6 detections for general monitoring
Auto-extracted: 6 detections for inject
Auto-extracted: 5 detections for process creation monitoring
Auto-extracted: 4 detections for persist
Auto-extracted: 3 detections for inject
Auto-extracted: 2 detections for service
Auto-extracted: 2 detections for parent process
Auto-extracted: 2 detections for service
Auto-extracted: 2 detections for container
Auto-extracted: 2 detections for privilege
Auto-extracted: 2 detections for persist
Auto-extracted: 2 detections for persist
Auto-extracted: 2 detections for suspicious
Auto-extracted: 2 detections for startup
Auto-extracted: 2 detections for bypass
Auto-extracted: 2 detections for masquerad
Auto-extracted: 2 detections for unusual
Auto-extracted: 2 detections for dll side
Auto-extracted: 1 detections for kernel
Auto-extracted: 1 detections for masquerad
Auto-extracted: 1 detections for child process
Auto-extracted: 1 detections for unusual
Auto-extracted: 1 detections for service
Auto-extracted: 1 detections for privilege
Auto-extracted: 1 detections for registry
Auto-extracted: 1 detections for persist
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for service
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for privilege
Auto-extracted: 1 detections for persist
Auto-extracted: 1 detections for registry
Auto-extracted: 1 detections for exfiltrat
Auto-extracted: 1 detections for inject
Auto-extracted: 1 detections for privilege
Auto-extracted: 1 detections for c2
Auto-extracted: 1 detections for kernel
Auto-extracted: 1 detections for remote
Auto-extracted: 1 detections for service
Auto-extracted: 1 detections for kernel
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for kernel
Auto-extracted: 1 detections for child process
Auto-extracted: 1 detections for parent process
Auto-extracted: 1 detections for remote
Auto-extracted: 1 detections for dll side
Auto-extracted: 1 detections for bypass
Auto-extracted: 1 detections for service