Technique T1574

Hijack Execution Flow

CLEARED FOR PUBLIC RELEASE · OPEN-SOURCE INTELLIGENCE

Hijack Execution Flow (T1574) — a Defense Evasion technique, observed in public incident reporting.

MITRE ATT&CKT1574

TacticDefense Evasion

Incidents on file25

Detection & mitigation

Monitor for unexpected file access patterns or creation of symbolic links in directories used by Nessus Agent. Apply vendor patches when available.

Observed in the wild

2026-08-22

dll sideloading
Tenable Nessus Agent Link Following Vulnerability

2026-08-17

dll sideloading
SilverFox APT Uses Fake Claude Apps to Target Asian Companies

2026-08-16

dll sideloading
Microsoft Defender for Endpoint Zero-Day Allows DLL Sideloading via Cloud Hydration

2026-08-14

dll sideloading
Bring Your Own EDR Attack Weaponizes SentinelOne to Bypass Windows Security

2026-08-06

dll sideloading
SilverFox Malware Uses DLL Sideloading and Kernel Drivers to Disable Endpoint Security

2026-06-01

dll sideloading
Operation Dragon Weave: China-Aligned Cyber Espionage Campaign Targets Czech Republic and Taiwan

2026-05-26

dll sideloading
Cryptojacking campaign uses SEO poisoning and AI chatbot delivery to deploy ScreenConnect for GPU mining

2026-05-22

dll sideloading
Iranian APT Screening Serpens Uses AppDomainManager Hijacking and New RAT Variants in Espionage Campaigns

2026-05-14

dll sideloading
Seedworm APT Uses Signed SentinelOne Binary for DLL Sideloading in Global Espionage Campaign

2026-05-13

dll sideloading
Nitrogen Ransomware Breaches Foxconn, Exfiltrates 8TB of Supply Chain Data

2026-05-11

dll sideloading
EtherRat and TukTuk Malware Lead to The Gentleman Ransomware Deployment

2026-04-02

dll sideloading
Qilin ransomware deploys multi-stage EDR killer via malicious msimg32.dll

2026-03-30

dll sideloading
Infostealer Campaign Uses DLL Sideloading with Signed Microsoft Office Binary to Evade Detection

2026-03-08

dll sideloading
Windows Defender Execution Folder Hijack via Symbolic Link

2026-01-30

dll sideloading
Local Privilege Escalation in ESET Inspect Connector via OpenSSL DLL Hijacking

2025-11-01

dll sideloading
EDR-Redir V2 Uses Bind Links to Redirect EDR Parent Folders

2025-10-03

dll sideloading
CVE-2025-27237: Zabbix Agent for Windows Local Privilege Escalation via OpenSSL Config DLL Injection

2025-09-20

dll sideloading
McAfee Agent 5.x prior to 5.7.3 Multiple Vulnerabilities

2025-07-30

dll sideloading
CVE-2025-25011: Elastic Beats Uncontrolled Search Path Element Leading to Local Privilege Escalation

2025-06-10

dll sideloading
Chinese Cyberespionage Groups Target SentinelOne in ShadowPad and PurpleHaze Campaigns

2025-04-07

dll sideloading
ToddyCat APT Exploits ESET Command-Line Scanner Vulnerability to Bypass Windows Security

2025-04-04

dll sideloading
Ivanti Endpoint Manager DLL Hijacking Privilege Escalation Vulnerability

2024-09-12

dll sideloading
CVE-2024-20430: Cisco Meraki Systems Manager Agent for Windows Privilege Escalation

2024-09-10

dll sideloading
CVE-2024-8441: Ivanti Endpoint Manager Agent Uncontrolled Search Path Privilege Escalation

2024-04-23

dll sideloading
eScan Antivirus Update Mechanism Abused via MitM to Distribute GuptiMiner Malware

Track this in real time.

ColdRecon watches the public signal so you don't have to — a daily brief and a live detection-coverage desk. Request clearance.

Request Clearance →