Security ArtifactsDFIR Intelligence
SearchSign inSubscribe

T1574.005sub-technique of T1574 Hijack Execution Flow

Executable Installer File Permissions Weakness

Windowsnothing on this site yetT1574.005 on attack.mitre.org

Adversaries may execute their own malicious payloads by hijacking the binaries used by an installer. These processes may automatically execute specific binaries as part of their functionality or to perform other actions. If the permissions on the file system directory containing a target binary, or permissions on the binary itself, are improperly set, then the target binary may be overwritten with another binary using user-level permissions and executed...

MITRE ATT&CK 19.2, retrieved 2026-09-12

If this is happening now

1

Checklists and playbooks to open while the alert is still live.

how MITRE says to see it

Detection Strategy for Hijack Execution Flow using Executable Installer File Permissions Weakness

  • Executables written or modified in installer directories (e.g., %TEMP% subdirectories or Program Files installer paths) followed by execution under elevated context.

what reduces it

  • M1052 User Account Control. Turn off UAC's privilege elevation for standard users `[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]` to automatically deny elevation requests, add: `"ConsentPromptBehaviorUser"=dword:00000000`. Consider enabling installer detection for all users by adding: `"EnableInstallerDetection"=dword:00000001`. This will prompt for a password for installation and also log the attempt.
  • M1018 User Account Management. Limit privileges of user accounts and groups so that only authorized administrators can interact with service changes and service binary target path locations. Deny execution from user directories such as file download directories and temp directories where able.
  • M1047 Audit. Use auditing tools capable of detecting file system permissions abuse opportunities on systems within an enterprise and correct them. Toolkits like the PowerSploit framework contain PowerUp modules that can be used to explore systems for service file system permissions weaknesses.

the rest of T1574

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.