Path Interception by PATH Environment Variable
Adversaries may execute their own malicious payloads by hijacking environment variables used to load libraries. The PATH environment variable contains a list of directories (User and System) that the OS searches sequentially through in search of the binary that was called from a script or the command line. Adversaries can place a malicious program in an earlier entry in the list of directories stored in the PATH environment variable, resulting in the operating system executing the malicious bi...
BY SOURCE
PROCEDURES (7)
Auto-extracted: 1 detections for bypass
Auto-extracted: 1 detections for privilege
Auto-extracted: 1 detections for privilege
Auto-extracted: 1 detections for process creation monitoring
Auto-extracted: 1 detections for privilege
Auto-extracted: 1 detections for command line monitoring
Auto-extracted: 1 detections for bypass