What technique places an executable in a path so that the application will execute it in place of the legitimate target?

What technique places an executable in a path so that the application will execute it in place of the legitimate target?

• A. Scheduled Task
• B. Path Interception
• C. Relaying
• D. Pivoting

Answer: (B)

System path resolution and execution order are being tested. Path Interception occurs when an attacker places a malicious executable with the same name as a legitimate target in a directory that is searched earlier in the system’s search path. Because the operating system runs the first matching file it finds, the attacker’s binary gets executed in place of the real program. For example, if a program is started by name and the PATH includes a directory ahead of the legitimate one, a malicious file with the same name in that earlier directory will be found first and run instead of the genuine target. This is different from techniques that rely on scheduling tasks or moving laterally in a network; those approaches don’t directly swap out a binary at runtime based on the search path. Defenses involve ensuring the system doesn’t rely on potentially untrusted path entries: use absolute paths when launching executables, restrict or securely order the PATH so trusted directories come first, implement application whitelisting or code signing, and monitor for files with names matching legitimate binaries appearing in unexpected locations.

System path resolution and execution order are being tested. Path Interception occurs when an attacker places a malicious executable with the same name as a legitimate target in a directory that is searched earlier in the system’s search path. Because the operating system runs the first matching file it finds, the attacker’s binary gets executed in place of the real program.

For example, if a program is started by name and the PATH includes a directory ahead of the legitimate one, a malicious file with the same name in that earlier directory will be found first and run instead of the genuine target. This is different from techniques that rely on scheduling tasks or moving laterally in a network; those approaches don’t directly swap out a binary at runtime based on the search path.

Defenses involve ensuring the system doesn’t rely on potentially untrusted path entries: use absolute paths when launching executables, restrict or securely order the PATH so trusted directories come first, implement application whitelisting or code signing, and monitor for files with names matching legitimate binaries appearing in unexpected locations.