Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

Hijack Execution Flow

Sub-techniques (12)

ID	Name
.001	DLL Search Order Hijacking
.002	DLL Side-Loading
.004	Dylib Hijacking
.005	Executable Installer File Permissions Weakness
.006	Dynamic Linker Hijacking
.007	Path Interception by PATH Environment Variable
.008	Path Interception by Search Order Hijacking
.009	Path Interception by Unquoted Path
.010	Services File Permissions Weakness
.011	Services Registry Permissions Weakness
.012	COR_PROFILER
.013	KernelCallbackTable

Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs. Hijacking execution flow can be for the purposes of persistence, since this hijacked execution may reoccur over time. Adversaries may also use these mechanisms to elevate privileges or evade defenses, such as application control or other restrictions on execution. There are many ways an adversary may hijack the flow of execution, including by manipulating how the operating system locates programs to be executed. How the operating system locates libraries to be used by a program can also be intercepted. Locations where the operating system looks for programs/resources, such as file directories and in the case of Windows the Registry, could also be poisoned to include malicious payloads.

ID: T1574

Sub-techniques: .001 .002 .004 .005 .006 .007 .008 .009 .010 .011 .012 .013

Tactic(s): Defense Evasion, Persistence, Privilege Escalation

Platforms: Linux, macOS, Windows

Data Sources: Command: Command Execution, File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation, Service: Service Metadata, Windows Registry: Windows Registry Key Modification

Version: 1.2

Created: 12 Mar 2020

Last Modified: 05 May 2022

Name	Description
Procedure Examples
Dtrack	One of Dtrack can replace the normal flow of a program execution with malicious code.(Citation: CyberBit Dtrack)
ShimRat	ShimRat can hijack the cryptbase.dll within migwiz.exe to escalate privileges and bypass UAC controls.(Citation: FOX-IT May 2016 Mofang)
Denis	Denis replaces the nonexistent Windows DLL "msfte.dll" with its own malicious version, which is loaded by the SearchIndexer.exe and SearchProtocolHost.exe.(Citation: Cybereason Cobalt Kitty 2017)

Mitigation	Description
Mitigations
User Account Control	Configure Windows User Account Control to mitigate risk of adversaries obtaining elevated process access.
Behavior Prevention on Endpoint	Use capabilities to prevent suspicious behavior patterns from occurring on endpoint systems. This could include suspicious process, file, API call, etc. behavior.
Restrict Library Loading	Prevent abuse of library loading mechanisms in the operating system and software to load untrusted code by configuring appropriate library loading mechanisms and investigating potential vulnerable software.
Audit	Perform audits or scans of systems, permissions, insecure software, insecure configurations, etc. to identify potential weaknesses.
Application Developer Guidance	This mitigation describes any guidance or training given to developers of applications to avoid introducing security weaknesses that an adversary may be able to take advantage of.
User Account Management	Manage the creation, modification, use, and permissions associated to user accounts.
Update Software	Perform regular software updates to mitigate exploitation risk.
Execution Prevention	Block execution of code on a system through application control, and/or script blocking.
Restrict File and Directory Permissions	Restrict access by setting directory and file permissions that are not specific to users or privileged accounts.
Restrict Registry Permissions	Restrict the ability to modify certain hives or keys in the Windows Registry.

Detection

Monitor file systems for moving, renaming, replacing, or modifying DLLs. Changes in the set of DLLs that are loaded by a process (compared with past behavior) that do not correlate with known software, patches, etc., are suspicious. Monitor DLLs loaded into a process and detect DLLs that have the same file name but abnormal paths. Modifications to or creation of .manifest and .local redirection files that do not correlate with software updates are suspicious. Look for changes to binaries and service executables that may normally occur during software updates. If an executable is written, renamed, and/or moved to match an existing service executable, it could be detected and correlated with other suspicious behavior. Hashing of binaries and service executables could be used to detect replacement against historical data. Monitor for changes to environment variables, as well as the commands to implement these changes. Monitor processes for unusual activity (e.g., a process that does not use the network begins to do so, abnormal process call trees). Track library metadata, such as a hash, and compare libraries that are loaded at process execution time against previous executions to detect differences that do not correlate with patching or updates. Service changes are reflected in the Registry. Modification to existing services should not occur frequently. If a service binary path or failure parameters are changed to values that are not typical for that service and does not correlate with software updates, then it may be due to malicious activity. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as network connections made for Command and Control, learning details about the environment through Discovery, and Lateral Movement. Tools such as Sysinternals Autoruns may also be used to detect system changes that could be attempts at persistence, including listing current service information. (Citation: Autoruns for Windows) Suspicious program execution through services may show up as outlier processes that have not been seen before when compared against historical data.

References

Связанные риски

Ничего не найдено

Каталоги

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.