Security ArtifactsDFIR Intelligence
SearchSign inSubscribe

T1574.014sub-technique of T1574 Hijack Execution Flow

AppDomainManager

Windowsnothing on this site yetT1574.014 on attack.mitre.org

Adversaries may execute their own malicious payloads by hijacking how the.NET `AppDomainManager` loads assemblies. The.NET framework uses the `AppDomainManager` class to create and manage one or more isolated runtime environments (called application domains) inside a process to host the execution of.NET applications. Assemblies (`.exe` or `.dll` binaries compiled to run as.NET code) may be loaded into an application domain as executable code.

MITRE ATT&CK 19.2, retrieved 2026-09-12

If this is happening now

1

Checklists and playbooks to open while the alert is still live.

how MITRE says to see it

Detection Strategy for Hijack Execution Flow through the AppDomainManager on Windows.

  • Detection focuses on unauthorized manipulation of.NET AppDomainManager behavior. Defenders may observe suspicious creation of new AppDomains within trusted processes, anomalous loading of assemblies via non-standard configuration files, or registry/environment variable changes redirecting AppDomainManager to malicious...

what reduces it

  • M1022 Restrict File and Directory Permissions. Install.NET applications and related software in write-protected locations. Set directory access controls to prevent file writes to the search paths for.NET applications, both in the folders where applications are run from and the standard resources folders.

the rest of T1574

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.