Hijack Execution Flow: KernelCallbackTable T1574.013

Tactics: Stealth, Execution

Adversaries may abuse the KernelCallbackTable of a process to hijack its execution flow in order to run their own payloads. The KernelCallbackTable can be found in the Process Environment Block (PEB) and is initialized to an array of graphic functions available to a GUI process once user32.dll is loaded.

Authoring guide

These 2 rules share fields, values, and exclusions.

Fields filtered most (7 distinct)

These fields appear most often in rule filters.

FieldRulesHowSample values
EventType2eq 2session_id_change, uid_change
host.os.type2eq 2
user.id2eq 20
event.category1eq 1process
event.type1eq 1change
parent_process_name1in 1bash, csh, dash
process_name1starts_with 1kworker

Top indicator values (14 distinct)

These values appear most often in rule predicates.

FieldKindValueRules (here)Corpus reach
user.ideq
0
228
EventTypeeq
session_id_change
12
EventTypeeq
uid_change
119
event.categoryeq
process
1141
event.typeeq
change
195
parent_process_namein
bash
166
parent_process_namein
csh
140
parent_process_namein
dash
143
parent_process_namein
fish
141
parent_process_namein
ksh
141
parent_process_namein
sh
166
parent_process_namein
tcsh
141
parent_process_namein
zsh
164
process_namestarts_with
kworker
14

Exclusions (53 distinct)

These values appear most often in top-level exclusions.

FieldKindValueRules excluding
Imageeq
/opt/gitlab/embedded/sbin/logrotate
1
Imageeq
/opt/puppetlabs/puppet/bin/puppet
1
Imageeq
/opt/puppetlabs/puppet/bin/ruby
1
Imageeq
/usr/lib/postfix/sbin/master
1
Imageeq
/usr/lib/snapd/snap-confine
1
Imageeq
/usr/libexec/postfix/local
1
Imageeq
/var/lib/snapd/snap/bin/node
1
Imagestarts_with
/bin/
1
Imagestarts_with
/etc/apt/universal-hooks/
1
Imagestarts_with
/opt/cisco/
1
Imagestarts_with
/opt/dynatrace/
1
Imagestarts_with
/opt/microsoft/
1
Imagestarts_with
/opt/psa/admin/
1
Imagestarts_with
/run/k3s/containerd/
1
Imagestarts_with
/sbin/
1

Rules under this technique

These vendors publish rules tagged with this technique.

Platform: Linux

Domain: Endpoint

Elastic 2 rules