Search Order Hijacking (T1574.008): Detect and Prevent

Path Interception by Search Order Hijacking (T1574.008) is a Windows technique in the stealth and execution tactics. The adversary abuses the order in which Windows looks for programs that are called without a path.

How attackers use it

Some programs start other programs without giving the full path. Windows then searches in a defined order, and it commonly checks the directory of the initiating program before the Windows system directory. If an adversary finds a program that does not specify a path, they can create a program with the expected name and place it in the initiating program's directory.

MITRE's example: example.exe runs cmd.exe with the argument net user. An adversary places a program called net.exe next to example.exe, and that one runs instead of the Windows utility. MITRE adds a detail about extension order. If an adversary places net.com in the same directory as net.exe, then cmd.exe /C net user runs net.com, because of the order of extensions in PATHEXT.

Unlike DLL search order hijacking, the search order here depends on the method used to start the program. MITRE notes that search order hijacking is also a common way to hijack DLL loads, covered in T1574.001.

How to detect it

MITRE's analytic looks for processes running binaries named after legitimate system utilities, such as net.exe, findstr.exe or python.exe, from non-standard or application-specific directories. Combine that with file creation or modification events for those binaries, file writes in vulnerable directories, and odd parent-child relationships in process lineage.

A short hunting rule: system utility name plus a path that is not the system directory.

How to reduce the risk

1. Execution prevention. Adversaries need to place new binaries in locations to run them. Application control such as Windows Defender Application Control, AppLocker or Software Restriction Policies can block execution from unexpected places.
2. Restrict file and directory permissions. Deny users write access to the top-level C: directory and system directories, and keep executables in write-protected directories.
3. Audit. Find and fix path interception weaknesses in configuration files, scripts, PATH, services and shortcuts. Know the Windows search order and use fully qualified paths wherever appropriate.

Check your own environment

# Windows PowerShell: extension order used to resolve bare command names
$env:PATHEXT

• Do any in-house tools or scripts call utilities by bare name when running with privilege?
• Are applications installed in folders that standard users can write to?
• Do you alert on a system utility name executing from an application folder?

Quick check

Sources

• MITRE ATT&CK T1574.008: Path Interception by Search Order Hijacking