ATT&CK technique
View on MITRE ATT&CK →
T1574.008
Path Interception by Search Order Hijacking
StealthExecution
4 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| splunk | Windows Get-Variable.EXE Execution from WindowsApps Folder | production | 2026-10-02 |
| elastic | Signed Proxy Execution via MS Work Folders | production | 2026-09-18 |
| sigma | Potential Notepad++ CVE-2025-49144 Exploitation | experimental | 2025-06-26 |
| sigma | Using SettingSyncHost.exe as LOLBin | test | 2021-11-27 |