Applied Cybernetics Group
T1546 Event Triggered Execution
- Technique
T1546- Tactics
- Privilege Escalation, Persistence
- Research, 90 days
- 1
- KEV CVEs mapped
- 0
- SigmaHQ rules
- 10
- Elastic, Splunk
- 74
- thrunt rules
- 0
- Upstream
- https://attack.mitre.org/techniques/T1546
MITRE description
Adversaries may establish persistence and/or elevate privileges using system mechanisms that trigger execution based on specific events. Various operating systems have means to monitor and subscribe to events such as logons or other user activity such as running specific applications/binaries. Cloud environments may also support various functions and services that monitor and can be invoked in response to specific cloud events.(Citation: Backdooring an AWS account)(Citation: Varonis Power Automate Data Exfiltration)(Citation: Microsoft DART Case Report 001) Adversaries may abuse these mechanisms as a means of maintaining persistent access to a victim via repeatedly executing malicious code. After gaining access to a victim system, adversaries may create/modify event triggers to point to malicious content that will be executed whenever the event trigger is invoked.(Citation: FireEye WMI 2015)(Citation: Malware Persistence on OS X)(Citation: amnesia malware) Since the execution can be proxied by an account with higher permissions, such as SYSTEM or service accounts, an adversary may be able to abuse these triggered execution mechanisms to escalate their privileges.
Research citing this technique
Reports and advisories from the last 90 days that cite this technique.
-
2026-08-13Recorded Future Insikt: Malware Crypting Services and the Threat Actors Who Sell Them
Detection coverage
SigmaHQ community rules
- HAFNIUM Exchange Exploitation Activity (emerging-threats)
- SOURGUM Actor Behaviours (emerging-threats)
- MSSQL Extended Stored Procedure Backdoor Maggie (emerging-threats)
- New Outlook Macro Created (core)
- Suspicious Outlook Macro Created (core)
- Suspicious Get-Variable.exe Creation (core)
- Control Panel Items (core)
- COM Hijack via Sdclt (core)
- Potential Persistence Via Outlook LoadMacroProviderOnBoot Setting (core)
- Outlook Macro Execution Without Warning Setting Enabled (core)
Elastic and Splunk rules
- Unusual Process Modifying GenAI Configuration File (elastic)
- Bash Shell Profile Modification (elastic)
- Trap Signals Execution (elastic)
- AWS EKS Admission Webhook Created or Modified (elastic)
- AWS Lambda Function Policy Updated to Allow Public Invocation (elastic)
- AWS Lambda Function Policy Updated to Allow Cross-Account Invocation (elastic)
- AWS Lambda Event Source Mapping Creation (elastic)
- AWS SageMaker Notebook Lifecycle Configuration With Suspicious Script Content (elastic)
- Azure Automation Webhook Created (elastic)
- Modification of Persistence Relevant Files Detected via Defend for Containers (elastic)
- Suspicious Echo or Printf Execution Detected via Defend for Containers (elastic)
- Potential release_agent Container Escape Detected via Defend for Containers (elastic)
- Potential Persistence via File Modification (elastic)
- GKE Admission Webhook Created or Modified (elastic)
- GitHub Actions Workflow Modification Blocked (elastic)
- Kubernetes Admission Webhook Created or Modified (elastic)
- Pod or Container Creation with Suspicious Command-Line (elastic)
- Suspicious APT Package Manager Execution (elastic)
- APT Package Manager Configuration File Creation (elastic)
- Suspicious APT Package Manager Network Connection (elastic)
- Binfmt Configuration File Creation (elastic)
- D-Bus Service Created (elastic)
- DNF Package Manager Plugin File Creation (elastic)
- DPKG Package Installed by Unusual Parent Process (elastic)
- Unusual DPKG Execution (elastic)
Showing 25 of 74.