ATT&CK technique
View on MITRE ATT&CK →
T1574.007
Path Interception by PATH Environment Variable
StealthExecution
9 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| elastic | Suspicious Path Invocation from Command Line | production | 2026-09-18 |
| elastic | Privilege Escalation via Windir Environment Variable | production | 2026-09-18 |
| elastic | Modification of Environment Variable via Unsigned or Untrusted Parent | production | 2026-09-18 |
| elastic | Potential Privilege Escalation via PKEXEC | production | 2026-09-18 |
| splunk | Python PYTHONPATH Modification During Package Installation | production | 2026-08-21 |
| elastic | Potential CVE-2025-41244 vmtoolsd LPE Exploitation Attempt | deprecated | 2026-08-03 |
| splunk | Linux Possible Privilege Escalation via PYTHONPATH | production | 2026-07-08 |
| sigma | Trusted Path Bypass via Windows Directory Spoofing | experimental | 2025-06-17 |
| sigma | Potential Suspicious Activity Using SeCEdit | test | 2022-12-30 |