CAPEC-30
Hijacking a Privileged Thread of Execution
An adversary hijacks a privileged thread of execution by injecting malicious code into a running process. By using a privleged thread to do their bidding, adversaries can evade process-based detection that would stop an attack that creates a new process. This can lead to an adversary gaining access to the process's memory and can also enable elevated privileges. The most common way to perform this attack is by suspending an existing thread and manipulating its memory.
On this page
Ask an AI about this attack pattern
Show the prompt
Explain the attack pattern CAPEC-30: Hijacking a Privileged Thread of Execution: how it unfolds, what it needs and how to prevent and detect it in my systems. Use https://capec.mitre.org/data/definitions/30.html and https://cve.bz/cve/capec/30?via=ask-ai-copy, which lists recent CVEs with the weaknesses it exploits. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this attack pattern's id and public links.
How the attack unfolds
Explore
The attacker looks for a way in.
[Determine target thread] The adversary determines the underlying system thread that is subject to user-control
Experiment
They probe what they found.
[Gain handle to thread] The adversary then gains a handle to a process thread.
2 techniques
- Use the "OpenThread" API call in Windows on a known thread.
- Cause an exception in a java privileged block public function and catch it, or catch a normal signal. The thread is then hanging and the adversary can attempt to gain a handle to it.
[Alter process memory] Once the adversary has a handle to the target thread, they will suspend the thread and alter the memory using native OS calls.
1 technique
- On Windows, use "SuspendThread" followed by "VirtualAllocEx", "WriteProcessMemory", and "SetThreadContext".
Exploit
They carry out the attack.
[Resume thread execution] Once the process memory has been altered to execute malicious code, the thread is then resumed.
1 technique
- On Windows, use "ResumeThread".
Prerequisites
The application in question employs a threaded model of execution with the threads operating at, or having the ability to switch to, a higher privilege level than normal users
In order to feasibly execute this class of attacks, the adversary must have the ability to hijack a privileged thread. This ability includes, but is not limited to, modifying environment variables that affect the process the thread belongs to, or calling native OS calls that can suspend and alter process memory. This does not preclude network-based attacks, but makes them conceptually more difficult to identify and execute.
Skills required
- High skill
Hijacking a thread involves knowledge of how processes and threads function on the target platform, the design of the target application as well as the ability to identify the primitives to be used or manipulated to hijack the thread.
Resources required
None: No specialized resources are required to execute this type of attack. The adversary needs to be able to latch onto a privileged thread.
The adversary does, however, need to be able to program, compile, and link to the victim binaries being executed so that it will turn control of a privileged thread over to the adversary's malicious code. This is the case even if the adversary conducts the attack remotely.
Consequences
| Impact | Affects | Note |
|---|---|---|
| Gain Privileges | Confidentiality, Access Control, Authorization | |
| Execute Unauthorized Commands | Confidentiality, Integrity, Availability | Run Arbitrary Code |
Mitigations
Application Architects must be careful to design callback, signal, and similar asynchronous constructs such that they shed excess privilege prior to handing control to user-written (thus untrusted) code.
Application Architects must be careful to design privileged code blocks such that upon return (successful, failed, or unpredicted) that privilege is shed prior to leaving the block/scope.
Weaknesses it exploits
- CWE-270 Privilege Context Switching Error
Recent CVEs with these weaknesses
- 8.8CVE-2026-88200
Privilege context switching error in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
- 9.4CVE-2026-9560
Privilege escalation via background service of OpenVPN Connect 3.5.1 through 3.8.1 on macOS allows attackers to execute arbitrary commands with elevated privileges via local IPC channel
- 7.5CVE-2026-34853
Permission bypass vulnerability in the LBS module. Impact: Successful exploitation of this vulnerability may affect availability.
- 2.0CVE-2025-55210
FreePBX is an open-source web-based graphical user interface (GUI) that manages Asterisk. Prior to 17.0.5 and 16.0.17, FreePBX module api (PBX API) is vulnerable to privilege escalation by authenticated users with REST/GraphQL API access. …
- 7.8CVE-2025-60721
Privilege context switching error in Windows Administrator Protection allows an authorized attacker to elevate privileges locally.
- 8.1CVE-2025-9408
System call entry on Cortex M (and possibly R and A, but I think not) has a race which allows very practical privilege escalation for malicious userspace processes.
- 6.0CVE-2025-26499
Under heavy system utilization a random race condition can occur during authentication or token refresh operation. This flaw allows one user to be granted a token intended for another user, resulting in impersonation until the session is e…
- 5.6CVE-2025-46406
A Privilege Context Switching Error (CWE-270) in the Command Center Server could allow a privileged Operator with high level access in one Division to perform limited privileged activities across the Division boundary. This issue affects …
The newest records naming one of them. Each weakness's page lists them all.
Related attack patterns
- Part of
- CAPEC-233 Privilege Escalation
Examples
Adversary targets an application written using Java's AWT, with the 1.2.2 era event model. In this circumstan…
Adversary targets an application written using Java's AWT, with the 1.2.2 era event model. In this circumstance, any AWTEvent originating in the underlying OS (such as a mouse click) would return a privileged thread (e.g., a system call). The adversary could choose to not return the AWT-generated thread upon consuming the event, but instead leveraging its privilege to conduct privileged operations.
MITRE's words, unchanged: CAPEC-30 at MITRE. CAPEC is Copyright © 2007–2026, The MITRE Corporation, used under the CAPEC terms of use: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.” CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. Credits. All attack patterns.