Path Interception by Search Order Hijacking

ATT&CK T1574.008

Adversaries may execute their own malicious payloads by hijacking the search order used to load other programs. Because some programs do not call other programs using the full path, adversaries may place their own file in the directory where the calling program is located, causing the operating system to launch their malicious software at the request of the calling program. Search order hijacking occurs when an adversary abuses the order in which Windows searches for programs that are not given a path. Unlike [DLL](https://attack.mitre.org/techniques/T1574/001) search order hijacking, the sear

Category: Technique, stealth, execution

MITRE ATT&CK: T1574.008

Reference: MITRE ATT&CK T1574.008