DET0564: Detection Strategy for Hijack Execution Flow using Path Interception by Search Order Hijacking
MITRE ATT&CK DET0564: Detection Strategy for Hijack Execution Flow using Path Interception by Search Order Hijacking Detection Strategy details, with detection…
Security context for executives and security teams
This detection strategy is tied to Windows search order hijacking, where a program can be tricked into launching an attacker-controlled file because it calls another program without a full path. The business significance is that this behavior can turn normal application execution into stealthy code execution, making it relevant to endpoint hardening, SOC visibility, and incident response triage even when no exploit or malware family is specified.
Executive priority
Treat this as a control-validation topic for Windows execution risk: leaders should ask whether critical endpoints and business applications are monitored for unexpected child processes, suspicious file placement near legitimate executables, and abnormal execution paths. The priority is not based on a supplied campaign or active exploitation claim; it is based on the technique’s potential to bypass casual user visibility and blend malicious execution into legitimate application activity.
Technical view
The ATT&CK relationship says DET0564 detects T1574.008, Path Interception by Search Order Hijacking, in the enterprise domain, associated with Windows, execution, and stealth. Because the detection-strategy object itself provides no official detection logic or platform field, SOC and detection engineering teams should validate coverage against the related technique: identify processes that launch executables without expected fully qualified paths, unexpected binaries located in application working directories, and abnormal parent-child process relationships involving trusted programs. Incident responders should preserve process execution history and file-system context around the calling program and launched binary.
Likely telemetry
- Windows process creation events with parent process, child process, command line, image path, current working directory, and user context
- File creation or modification events in application directories and other locations from which legitimate programs may launch dependencies or helper executables
- Endpoint detection and response telemetry showing process lineage and executable metadata
- Application inventory or allowlist data to compare expected versus unexpected executable locations
- File metadata such as signature status, hash, creation time, and path
Detection direction
- Validate whether detections can distinguish expected helper-program launches from unexpected binaries loaded or executed from the caller’s directory or working directory.
- Tune around known software updaters, installers, developer tools, and administrative scripts, which may legitimately create or launch files in application-adjacent paths.
- Correlate process execution with recent file creation in the same directory to reduce noise and improve triage value.
- Use the related technique context to focus on Windows execution and stealth behaviors; do not assume coverage from this detection-strategy object alone because no official detection text was supplied.
- Confirm that telemetry includes full executable paths and parent-child process relationships; missing path detail is a major blind spot for this behavior.
Mitigation priorities
- Prioritize application and endpoint hardening that reduces ambiguous program execution paths, including requiring explicit paths where administratively feasible.
- Restrict write permissions to application directories and other locations where trusted programs may search for executables.
- Use application control or allowlisting where appropriate to limit execution from unexpected directories.
- Maintain endpoint logging and retention sufficient to reconstruct process lineage and file placement during investigation.
- Review critical business applications for unsafe execution assumptions during security assessments, especially on Windows systems supporting important operations.
Additional notes and limits
The source object is a detection strategy with no official description, detection text, tactics, or platforms specified. The practical guidance here is derived from its explicit relationship to ATT&CK technique T1574.008, whose supplied context identifies Windows, execution, stealth, and search order hijacking behavior.
This take cannot assert a specific analytic, rule, data source, product capability, prevalence, actor use, or active exploitation because those details were not supplied. Local validation is required to determine whether an environment collects the necessary Windows process and file telemetry and whether business applications are exposed to unsafe search-order behavior.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Detection Strategy for Hijack Execution Flow using Path Interception by Search Order Hijacking
No official description is available in the imported ATT&CK source object.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Techniques used
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1574.008 | Path Interception by Search Order HijackingSub-technique | This object detects Path Interception by Search Order Hijacking. |
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Imported snapshots across ATT&CK releases(1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.0 | Current bundle | 237ebb8a8eb6… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
- [1]mitre-attackDET0564Open source URL
- [2]mitre-attackDET0564Open source URL
- [3]mitre-attackDET0564Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.