MITRE ATT&CK technique · stealth, Execution

`T1574.013` KernelCallbackTable

Sub-technique of T1574 Hijack Execution Flow

Adversaries may abuse the KernelCallbackTable of a process to hijack its execution flow in order to run their own payloads.(Citation: Lazarus APT January 2022)(Citation: FinFisher exposed ) The KernelCallbackTable can be found in the Process Environment Block (PEB) and is initialized to an array of graphic functions available to a GUI process once user32.dll is loaded.(Citation: Windows Process…

MITRE ATT&CK page ↗

Who uses it · with stories on Jábega

Lazarus Group

Sigma rules to hunt it

SigmaHQ has no rules for this technique.

Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.