DET0004: Detection Strategy for Hijack Execution Flow using Path Interception by PATH Environment Variable.
MITRE ATT&CK DET0004: Detection Strategy for Hijack Execution Flow using Path Interception by PATH Environment Variable. Detection Strategy details, with detection…
Security context for executives and security teams
This detection strategy is about catching a subtle execution-flow problem: a system may run the wrong program because the PATH environment variable searches directories in order. If an adversary can place a malicious program earlier in that search path, normal scripts or command-line activity may execute the adversary’s program instead of the intended one. For leaders, the practical issue is trust in routine administration and automation across Linux, macOS, and Windows systems.
Executive priority
Prioritize this where business-critical scripts, privileged administration, build systems, or operational automation depend on PATH-based command execution. The decision value is not just malware detection; it is whether the organization can prove that trusted execution paths are controlled, monitored, and explainable during an incident or audit. Security leaders should ask whether endpoint logging captures both PATH changes and the actual executable path that ran, and whether teams know which PATH directories are writable by standard users or service accounts.
Technical view
The supplied detection-strategy object has no official description or detection text, but it detects ATT&CK T1574.007: Path Interception by PATH Environment Variable, associated with stealth and execution across Linux, macOS, and Windows. SOC and IR teams should validate whether telemetry can show environment-variable values, process ancestry, the resolved executable path, and file creation in directories that appear early in PATH. Detection engineering should focus on mismatches between expected command names and unexpected execution locations, especially when PATH is modified to place user-writable or unusual directories before trusted system directories.
Likely telemetry
- Process creation events with command line, parent process, user, and resolved executable path
- Environment variable changes or captured process environment values, especially PATH
- File creation, rename, or permission changes in directories included in PATH
- Shell, script, service, scheduled task, or startup configuration changes that affect PATH before execution
- Endpoint inventory or configuration data showing approved PATH entries and directory writability
Detection direction
- Baseline normal PATH values by operating system, role, service account, and administrative tooling before alerting on deviations.
- Alert on PATH modifications that insert unusual, temporary, user-writable, or newly created directories ahead of trusted system directories.
- Correlate suspicious PATH changes with subsequent process execution where the executable path differs from the expected trusted location for the invoked command name.
- Tune for legitimate developer, package-management, build, and administrative workflows that intentionally alter PATH.
- During triage, preserve process trees, environment values, executed file paths, and nearby file-write events; command-line-only telemetry may miss the key evidence.
Mitigation priorities
- Reduce reliance on implicit PATH search for privileged scripts and services; use explicit trusted paths where feasible.
- Restrict write permissions on directories that appear in PATH, especially entries searched before system locations.
- Standardize and document approved PATH values for servers, workstations, and service accounts.
- Monitor and review changes to environment-variable configuration as security-relevant configuration drift.
- Include PATH hijack checks in incident response collection and control validation for Linux, macOS, and Windows endpoints.
Additional notes and limits
This take is based on the detection-strategy object DET0004 and its relationship to T1574.007. Because the official detection-strategy fields do not include description, detection logic, platforms, or tactics, the practical guidance is derived from the related ATT&CK technique context only. Local baselines are essential because PATH behavior and legitimate modifications vary by operating system and operational role.
No official detection text, data sources, analytics, or mitigations were supplied for DET0004. The related technique supports Linux, macOS, and Windows and is associated with stealth and execution, but this response does not assert active exploitation, attribution, or existing detection coverage.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Detection Strategy for Hijack Execution Flow using Path Interception by PATH Environment Variable.
No official description is available in the imported ATT&CK source object.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Techniques used
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1574.007 | Path Interception by PATH Environment VariableSub-technique | This object detects Path Interception by PATH Environment Variable. |
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Imported snapshots across ATT&CK releases(1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.0 | Current bundle | fe27dd56a085… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
- [1]mitre-attackDET0004Open source URL
- [2]mitre-attackDET0004Open source URL
- [3]mitre-attackDET0004Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.