T1574ExecutionStealth
Hijack Execution Flow
Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs. Hijacking execution flow can be for the purposes of persistence, since this hijacked execution may reoccur over time. Adversaries may also use these mechanisms to elevate privileges or evade defenses, such as application control or other restrictions on execution. There are many ways an…
CVEs66
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.17
Reports1
Detections
8 Sigma rules tagged T1574Hijack Execution FlowT15748 general rules
- Exploiting SetupComplete.cmd CVE-2019-1378hightest
- Potential PrintNightmare Exploitation Attempthightest
- Suspicious Printer Driver Empty Manufacturerhightest
- DLL Execution Via Register-cimprovider.exemediumtest
- Potential Initial Access via DLL Search Order Hijackingmediumtest
- Potential Registry Persistence Attempt Via DbgManagedDebuggermediumtest
- Regsvr32 DLL Execution With Uncommon Extensionmediumtest
- Windows Spooler Service Suspicious Binary Loadinformationaltest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Hijack Execution Flow
66 CVEs, by priority. Each link shows its badge.- CVE-2023-3519Citrix NetScaler ADC and NetScaler Gateway Code Injection VulnerabilityCitrix · NetScaler ADC and NetScaler GatewayKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1574Hijack Execution Flow+2 more · 6 reportsMITRE CTID mapping of the KEV entry · how it is exploited99.7%Top 0.05%89.9priority
- CVE-2022-42475Fortinet FortiOS Heap-Based Buffer Overflow VulnerabilityFortinet · FortiOSKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1574Hijack Execution Flow+2 more · 4 reportsMITRE CTID mapping of the KEV entry · primary impact99.5%Top 0.06%88.8priority
- CVE-2023-27997Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow VulnerabilityFortinet · FortiOS and FortiProxy SSL-VPNKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1574Hijack Execution Flow+1 more · 1 reportMITRE CTID mapping of the KEV entry · how it is exploited85.7%Top 0.28%83.7priority
- CVE-2023-4966Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow VulnerabilityCitrix · NetScaler ADC and NetScaler GatewayKEVRansomwarePublic exploitHigh · 7.5T1574Hijack Execution FlowT1005Data from Local System1 reportMITRE CTID mapping of the KEV entry · how it is exploited>99.9%Top 0.01%82.1priority
- CVE-2022-1040Sophos Firewall Authentication Bypass VulnerabilitySophos · FirewallKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1078Valid Accounts+4 moreMITRE CTID mapping of the KEV entry · follow-on activity99.8%Top 0.04%79.9priority
- CVE-2024-21762Fortinet FortiOS Out-of-Bound Write VulnerabilityFortinet · FortiOSKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1574Hijack Execution FlowMITRE CTID mapping of the KEV entry · primary impact84.6%Top 0.3%79.8priority
- CVE-2022-41073Microsoft Windows Print Spooler Privilege Escalation VulnerabilityMicrosoft · WindowsKEVRansomwarePublic exploitHigh · 7.8T1078Valid AccountsT1574Hijack Execution Flow+1 moreMITRE CTID mapping of the KEV entry · follow-on activity2.4%Top 16%75.2priority
- CVE-2020-5735Amcrest Cameras and NVR Stack-based Buffer Overflow VulnerabilityAmcrest · Cameras and Network Video Recorder (NVR)KEVPublic exploitHigh · 8.8T1574Hijack Execution FlowT1499Endpoint Denial of ServiceMITRE CTID mapping of the KEV entry · primary impact36.2%Top 1.5%68.9priority
- CVE-2023-5217Google Chromium libvpx Heap Buffer Overflow VulnerabilityGoogle · Chromium libvpxKEVPublic exploitHigh · 8.8T1204.001Malicious LinkT1574Hijack Execution FlowMITRE CTID mapping of the KEV entry · primary impact49.0%Top 1.1%68.9priority
- CVE-2017-6742Cisco IOS and IOS XE Software SNMP Remote Code Execution VulnerabilityCisco · IOS and IOS XE SoftwareKEVPublic exploitHigh · 8.8T1574Hijack Execution FlowT1059Command and Scripting Interpreter+2 moreMITRE CTID mapping of the KEV entry · how it is exploited21.4%Top 2.4%68.7priority
- CVE-2022-3038Google Chromium Network Service Use-After-Free VulnerabilityGoogle · Chromium Network ServiceKEVPublic exploitHigh · 8.8T1204.001Malicious LinkT1574Hijack Execution FlowMITRE CTID mapping of the KEV entry · primary impact24.9%Top 2.1%68.7priority
- CVE-2025-27363FreeType Out-of-Bounds Write VulnerabilityFreeType · FreeTypeKEVPublic exploitHigh · 8.1T1574Hijack Execution FlowT1499.004Application or System ExploitationMITRE CTID mapping of the KEV entry · primary impact27.8%Top 1.9%68.3priority
- CVE-2019-15752Docker Desktop Community Edition Privilege Escalation VulnerabilityDocker · Desktop Community EditionKEVPublic exploitHigh · 7.8T1574Hijack Execution FlowT1068Exploitation for Privilege EscalationAI mapping from the description · primary impact48.6%Top 1.1%68.2priority
- CVE-2023-6549Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow VulnerabilityCitrix · NetScaler ADC and NetScaler GatewayKEVPublic exploitHigh · 7.5T1574Hijack Execution FlowT1499Endpoint Denial of ServiceMITRE CTID mapping of the KEV entry · how it is exploited57.6%Top 0.92%68.1priority
- CVE-2023-7024Google Chromium WebRTC Heap Buffer Overflow VulnerabilityGoogle · Chromium WebRTCKEVPublic exploitHigh · 8.8T1189Drive-by CompromiseT1574Hijack Execution FlowMITRE CTID mapping of the KEV entry · primary impact6.7%Top 6.1%67.9priority
- CVE-2016-1010Adobe Flash Player and AIR Integer Overflow VulnerabilityMITRE CTID mapping of the KEV entry · how it is exploited19.3%Top 2.7%67.5priority
- CVE-2022-41328Fortinet FortiOS Path Traversal VulnerabilityFortinet · FortiOSKEVHigh · 7.1T1574Hijack Execution FlowT1037Boot or Logon Initialization Scripts+2 more · 1 reportMITRE CTID mapping of the KEV entry · how it is exploited10.7%Top 4.2%66.0priority
- CVE-2020-3198Cisco IOS Software for Cisco Industrial Routers Arbitrary Code Execution VulnerabilitiesCisco · Cisco IOS 12.2(60)EZ16Critical · 9.8T1133External Remote ServicesT1190Exploit Public-Facing Application+3 moreMITRE CTID mapping of the CVE · primary impact4.6%Top 8.4%25.2priority
- CVE-2018-8353A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in…MITRE CTID mapping of the CVE · primary impact67.3%Top 0.7%24.9priority
- CVE-2018-8355A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft…MITRE CTID mapping of the CVE · primary impact67.9%Top 0.68%24.9priority
- CVE-2019-1118A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite…MITRE CTID mapping of the CVE · primary impact23.6%Top 2.2%24.6priority
- CVE-2020-16874Visual Studio Remote Code Execution VulnerabilityMicrosoft · Microsoft Visual Studio 2019 version 16.7 (includes 16.0 – 16.6)High · 7.8T1204.002Malicious FileT1574Hijack Execution Flow+5 moreMITRE CTID mapping of the CVE · primary impact4.3%Top 8.9%24.4priority
- CVE-2020-1569Microsoft Edge Memory Corruption VulnerabilityMITRE CTID mapping of the CVE · primary impact3.0%Top 13%23.6priority
- CVE-2019-3723Web Parameter Tampering VulnerabilityDell EMC · OpenManage Server AdministratorCritical · 9.1T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+2 moreMITRE CTID mapping of the CVE · follow-on activity1.8%Top 21%22.2priority
- CVE-2020-5254NetHack hilite_status parsing privilege escalationMITRE CTID mapping of the CVE · primary impact1.1%Top 34%21.0priority
- CVE-2020-3309Cisco Firepower Device Manager On-Box Software Arbitrary File Overwrite VulnerabilityCisco · Cisco Firepower Threat Defense SoftwareMedium · 6.5T1133External Remote ServicesT1190Exploit Public-Facing Application+2 moreMITRE CTID mapping of the CVE · primary impact1.8%Top 22%20.2priority
- CVE-2019-0609A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft…MITRE CTID mapping of the CVE · primary impact9.8%Top 4.4%19.8priority
- CVE-2019-6538Medtronic Conexus Radio Frequency Telemetry Protocol Improper Access ControlMedtronic · Conexus Radio Frequency Telemetry ProtocolCritical · 9.3T1574Hijack Execution FlowT1557Adversary-in-the-Middle+2 moreMITRE CTID mapping of the CVE · primary impact0.9%Top 40%19.8priority
- CVE-2020-1425A remoted code execution vulnerability exists in the way that Microsoft Windows Codecs Library handles objects in…Microsoft · Windows 10 Version 2004 for x64-based SystemsT1574Hijack Execution FlowT1499.004Application or System ExploitationMITRE CTID mapping of the CVE · primary impact9.3%Top 4.6%19.8priority
- CVE-2019-1052Chakra Scripting Engine Memory Corruption VulnerabilityMicrosoft · Microsoft Edge (EdgeHTML-based)Medium · 4.2T1189Drive-by CompromiseT1203Exploitation for Client Execution+2 moreMITRE CTID mapping of the CVE · primary impact2.4%Top 16%19.7priority
- CVE-2018-8248A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle…MITRE CTID mapping of the CVE · primary impact21.4%Top 2.4%19.5priority
- CVE-2018-8110A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft…MITRE CTID mapping of the CVE · primary impact16.9%Top 2.9%19.4priority
- CVE-2018-8111A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft…MITRE CTID mapping of the CVE · primary impact16.9%Top 2.9%19.4priority
- CVE-2019-0576A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in…MITRE CTID mapping of the CVE · primary impact17.0%Top 2.9%19.4priority
- CVE-2019-1035Microsoft Word Remote Code Execution VulnerabilityMicrosoft · Microsoft SharePoint Server 2019T1203Exploitation for Client ExecutionT1204.002Malicious File+2 moreMITRE CTID mapping of the CVE · primary impact6.6%Top 6.2%19.4priority
- CVE-2018-10636CNCSoft Version 1.00.83 and prior with ScreenEditor Version 1.00.54 has multiple stack-based buffer overflow…ICS-CERT · CNCSoft with ScreenEditorT1574Hijack Execution FlowT1068Exploitation for Privilege Escalation+1 moreMITRE CTID mapping of the CVE · primary impact9.4%Top 4.6%19.1priority
- CVE-2019-0911A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft…MITRE CTID mapping of the CVE · primary impact9.1%Top 4.7%19.1priority
- CVE-2019-1106A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in…MITRE CTID mapping of the CVE · primary impact9.2%Top 4.7%19.1priority
- CVE-2019-0926A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka 'Microsoft…MITRE CTID mapping of the CVE · primary impact8.1%Top 5.2%19.0priority
- CVE-2020-11039Integer Overflow in FreeRDPMITRE CTID mapping of the CVE · primary impact1.1%Top 34%18.9priority
- CVE-2020-1495Microsoft Excel Remote Code Execution VulnerabilityMicrosoft · Microsoft SharePoint Server 2010 Service Pack 2T1566PhishingT1204.002Malicious File+6 moreMITRE CTID mapping of the CVE · primary impact4.2%Top 9%18.9priority
- CVE-2020-4068Heap-based Buffer Overflow in APNSwiftkylebrowning · APNSwiftMedium · 6.3T1091Replication Through Removable MediaT1133External Remote Services+4 moreMITRE CTID mapping of the CVE · primary impact1.3%Top 29%18.6priority
- CVE-2018-17910WebAccess Versions 8.3.2 and priorMITRE CTID mapping of the CVE · primary impact5.2%Top 7.5%18.5priority
- CVE-2018-10620AVEVA InduSoft Web Studio v8.1 and v8.1SP1, and InTouch Machine Edition v2017 8.1 and v2017 8.1 SP1 a remote user…AVEVA Software, LLC · InduSoft Web StudioT1574Hijack Execution FlowMITRE CTID mapping of the CVE · primary impact4.2%Top 9.1%18.2priority
- CVE-2018-7499In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard…MITRE CTID mapping of the CVE · primary impact3.7%Top 10%18.0priority
- CVE-2020-1109Windows Update Stack Elevation of Privilege VulnerabilityMITRE CTID mapping of the CVE · primary impact1.0%Top 37%18.0priority
- CVE-2018-14819Fuji Electric V-Server 4.0.3.0 and prior, An out-of-bounds read vulnerability has been identified, which may allow…Fuji Electric · V-ServerT1574Hijack Execution FlowMITRE CTID mapping of the CVE · primary impact3.6%Top 11%17.9priority
- CVE-2018-18987VT-Designer Version 2.1.7.31 is vulnerable by the program populating objects with user supplied input via a file…MITRE CTID mapping of the CVE · follow-on activity3.2%Top 12%17.6priority
- CVE-2018-7494WPLSoft in Delta Electronics versions 2.45.0 and prior utilizes a fixed length stack buffer where a value larger than…ICS-CERT · Delta Electronics WPLSoftT1574Hijack Execution FlowT1499.004Application or System ExploitationMITRE CTID mapping of the CVE · primary impact2.7%Top 14%17.2priority
- CVE-2018-14809Fuji Electric V-Server 4.0.3.0 and prior, A use after free vulnerability has been identified, which may allow remote…MITRE CTID mapping of the CVE · primary impact2.7%Top 14%17.1priority
- CVE-2020-15208Data corruption in tensorflow-litetensorflow · tensorflowHigh · 7.4T1574Hijack Execution FlowT1499.004Application or System ExploitationMITRE CTID mapping of the CVE · primary impact0.9%Top 40%17.1priority
- CVE-2018-8835Double free vulnerabilities in Advantech WebAccess HMI Designer 2.1.7.32 and prior caused by processing specially…MITRE CTID mapping of the CVE · primary impact2.0%Top 19%16.2priority
- CVE-2020-11068Potential Buffer Overflow in LoRaMac-nodeLoRa · LoRaMac-nodeMedium · 5.0T1574Hijack Execution FlowT1499.004Application or System ExploitationMITRE CTID mapping of the CVE · primary impact0.9%Top 40%15.5priority
- CVE-2020-15199Denial of Service in Tensorflowtensorflow · tensorflowMedium · 5.9T1574Hijack Execution FlowT1499.004Application or System ExploitationMITRE CTID mapping of the CVE · primary impact0.8%Top 43%15.5priority
- CVE-2020-15211Out of bounds access in tensorflow-liteMITRE CTID mapping of the CVE · primary impact0.9%Top 40%15.4priority
- CVE-2020-0671An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka…MITRE CTID mapping of the CVE · primary impact1.4%Top 28%15.0priority
- CVE-2020-5210NetHack command line -w option parsing is subject to a buffer overflowMITRE CTID mapping of the CVE · primary impact0.8%Top 43%14.8priority
- CVE-2019-13522An attacker could use a specially crafted project file to corrupt the memory and execute code under the privileges of…MITRE CTID mapping of the CVE · primary impact1.4%Top 28%14.4priority
- CVE-2018-10610An out-of-bounds vulnerability in LeviStudioU, Versions 1.8.29 and 1.8.44 can be exploited when the application…WECON Technology Co., Ltd · LeviStudioUT1574Hijack Execution FlowT1557Adversary-in-the-Middle+2 moreMITRE CTID mapping of the CVE · primary impact1.1%Top 34%13.2priority
- CVE-2019-10980A type confusion vulnerability may be exploited when LAquis SCADA 4.3.1.71 processes a specially crafted project fileMITRE CTID mapping of the CVE · primary impact1.0%Top 37%12.6priority
- CVE-2020-0898An elevation of privilege vulnerability exists when the Windows Graphics Component improperly handles objects in…MITRE CTID mapping of the CVE · primary impact0.9%Top 41%11.8priority
- CVE-2020-5253Privilege escalation in NetHackMITRE CTID mapping of the CVE · primary impact0.5%Top 54%11.8priority
- CVE-2019-12660Cisco IOS XE Software ASIC Register Write VulnerabilityMITRE CTID mapping of the CVE · primary impact0.3%Top 77%8.4priority
- CVE-2018-11049RSA Identity Governance and Lifecycle Uncontrolled Search Path VulnerabilityPivotal · Pivotal Operations ManagerT1574Hijack Execution FlowMITRE CTID mapping of the CVE · primary impact0.4%Top 61%7.7priority
- CVE-2020-15100Uncontrolled Resource Consumption in freewvsMITRE CTID mapping of the CVE · primary impact0.3%Top 73%7.4priority
- CVE-2018-15376Cisco IOS Software for Cisco 800 Series Industrial Integrated Services Routers Arbitrary Memory Write VulnerabilitiesMITRE CTID mapping of the CVE · primary impact0.3%Top 74%5.2priority
Linked through a sub-technique
6 more- CVE-2020-3153Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path VulnerabilityCisco · AnyConnect SecureKEVRansomwarePublic exploitMedium · 6.5T1078Valid AccountsT1574.001DLL+1 more28.5%Top 1.9%77.2priority
- CVE-2026-110936Siemens Software Center Uncontrolled Search Path Element VulnerabilitySiemens · Software CenterKEVMedium · 6.7T1078Valid AccountsT1059Command and Scripting Interpreter+1 more1.0%Top 38%65.0priority
- CVE-2012-1854Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability20.9%Top 2.5%63.0priority
- CVE-2024-7262Kingsoft WPS Office Path Traversal Vulnerability3.1%Top 12%61.0priority
- CVE-2019-10971The application (Network Configurator for DeviceNet Safety 3.41 and prior) searches for resources by means of an…1.1%Top 36%12.9priority
- CVE-2019-1794Cisco Directory Connector Search Order Hijacking VulnerabilityCisco · Cisco Directory ConnectorMedium · 5.1T1078Valid AccountsT1574.008Path Interception by Search Order Hijacking0.4%Top 68%10.0priority