Detection Strategy for Hijack Execution Flow through the KernelCallbackTable on Windows.

Technique Detected:  KernelCallbackTable | T1574.013

ID: DET0577
Domains: Enterprise
Analytics: AN1593
Version: 1.0
Created: 21 October 2025
Last Modified: 21 October 2025

Analytics

AN1593

Unexpected modification of the KernelCallbackTable in a process’s PEB followed by invocation of modified callback functions (e.g., fnCOPYDATA) through Windows messages. Defender observes suspicious API call chains such as NtQueryInformationProcess → WriteProcessMemory → abnormal GUI callback execution, often correlating to anomalous process behavior such as network activity or code injection.

Log Sources
Data Component Name Channel
Process Access (DC0035) WinEventLog:Sysmon EventCode=10
Process Creation (DC0032) WinEventLog:Sysmon EventCode=1
OS API Execution (DC0021) etw:Microsoft-Windows-Kernel-Process WriteProcessMemory: WriteProcessMemory targeting regions containing KernelCallbackTable addresses
Mutable Elements
Field Description
MonitoredProcesses GUI applications (e.g., explorer.exe, notepad.exe) where KernelCallbackTable abuse is more likely.
CallbackFunctions Specific callback functions (e.g., fnCOPYDATA, fnDWORD) expected to remain stable.
TimeWindow Correlation interval between WriteProcessMemory calls and execution of modified callback functions.
AccessMaskThresholds Access rights values that should be flagged when targeting GUI processes.