T1546 Event Triggered Execution

privilege escalation · persistence — Linux, macOS, Windows, SaaS, IaaS, Office Suite · attack.mitre.org · JSON

MITRE detection strategy

analytics

Sigma rules tagged attack.t1546

KEV CVEs mapped here

Adversaries may establish persistence and/or elevate privileges using system mechanisms that trigger execution based on specific events. Various operating systems have means to monitor and subscribe to events such as logons or other user activity such as running specific applications/binaries. Cloud environments may also support various functions and services that monitor and can be invoked in response to specific cloud events.Adversaries may abuse these mechanisms as a means of maintaining persistent access to a victim via repeatedly executing malicious code. After gaining access to a victim system, adversaries may create/modify event triggers to point to malicious content that will be executed whenever the event trigger is invoked.Since the execution can be proxied by an account with higher permissions, such as SYSTEM or service accounts, an adversary may be able to abuse these triggered execution mechanisms to escalate their privileges.

KEV CVEs mapped to this technique · CTID Mappings Explorer

None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.

Detection strategy · ATT&CK Enterprise v19.2

DET0010 Behavioral Detection of Event Triggered Execution Across Platforms v1.0
AN0024 Windows
Correlates unexpected modifications to WMI event filters, scheduled task triggers, or registry autorun keys with subsequent execution of non-standard binaries by SYSTEM-level processes.

WinEventLog:Security EventCode=4698 → DC0001 Scheduled Job Creation
WinEventLog:WMI Creation or modification of __EventFilter, __FilterToConsumerBinding, or CommandLineEventConsumer → DC0008 WMI Creation
WinEventLog:Security EventCode=4657 → DC0063 Windows Registry Key Modification
WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

Tunable: UserContext TimeWindow PathAnomalyThreshold

AN0025 Linux
Detects inotify or auditd configuration changes that monitor system files coupled with execution of script interpreters or binaries by cron or systemd timers.

auditd:SYSCALL Inotify watch creation or auditctl changes on /etc/cron* or /lib/systemd/system/ → DC0059 File Metadata
linux:syslog Execution of non-standard script or binary by cron → DC0001 Scheduled Job Creation
auditd:SYSCALL Execution of script interpreters by systemd timer (ExecStart) → DC0064 Command Execution

Tunable: ExecutablePathRegex WatchTargetPaths

AN0026 macOS
Correlates launchd plist modifications with subsequent unauthorized script execution or anomalous parent-child process trees involving user agents.

macos:unifiedlog Modification of ~/Library/LaunchAgents or /Library/LaunchDaemons plist → DC0061 File Modification
macos:unifiedlog Execution of launchctl with suspicious arguments → DC0032 Process Creation

Tunable: PlistNamePattern ParentProcessBaseline

AN0027 IaaS
Monitors cloud function creation triggered by specific audit log events (e.g., IAM changes, object creation), followed by anomalous behavior from new service accounts.

AWS:CloudTrail CreateFunction → DC0069 Cloud Service Modification
AWS:CloudTrail InvokeFunction → DC0064 Command Execution

Tunable: TriggerEventType ServiceAccountRole

AN0028 SaaS
Correlates Power Automate or similar logic app workflows triggered by SaaS file uploads or email rules with data forwarding or anomalous access patterns.

m365:unified Creation of Power Automate flow triggered by OneDrive or Exchange event → DC0069 Cloud Service Modification
m365:unified Automated forwarding or file sync initiated by a logic app → DC0064 Command Execution

Tunable: TriggerCondition AppIdentityScope

AN0029 Office Suite
Detects macros or VBA triggers set to execute on document open or close events, often correlating with embedded payloads or C2 traffic shortly after execution.

m365:office VBA auto_open, auto_close, or document_open events → DC0029 Script Execution
m365:office External HTTP/DNS connection from Office binary shortly after macro trigger → DC0085 Network Traffic Content

Tunable: MacroFunctionNames TimeDeltaMacroToC2

Sigma rules · SigmaHQ da9bb07d64, tag `attack.t1546`

COM Hijack via Sdclt hightest

Author: Omkar Gudhate · 2020-09-27 (modified 2023-09-28) · logsource: product=windows category=registry_set · 07743f65-7ec9-404a-a519-913db7118a8d

Detects changes to 'HKCU\Software\Classes\Folder\shell\open\command\DelegateExecute'

Techniques: T1546 T1548

Control Panel Items hightest

Author: Kyaw Min Thein, Furkan Caliskan (@caliskanfurkan_) · 2020-06-22 (modified 2023-10-11) · logsource: product=windows category=process_creation · 0ba863e6-def5-4e50-9cea-4dd8c7dc46a4

Detects the malicious use of a control panel item

Techniques: T1218.002 T1546

Suspicious Get-Variable.exe Creation hightest

Author: frack113 · 2022-04-23 · logsource: product=windows category=file_event · 0c3fac91-5627-46e8-a6a8-a0d7b9b8ae1b

Get-Variable is a valid PowerShell cmdlet WindowsApps is by default in the path where PowerShell is executed. So when the Get-Variable command is issued on PowerShell execution, the system first looks for the Get-Variable executable in the path and executes the malicious binary instead of looking for the PowerShell cmdlet.

Techniques: T1546 T1027

Suspicious Outlook Macro Created hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-02-08 · logsource: product=windows category=file_event · 117d3d3a-755c-4a61-b23e-9171146d094c

Detects the creation of a macro file for Outlook.

Techniques: T1137 T1008 T1546

Potential Persistence Via Outlook LoadMacroProviderOnBoot Setting hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2021-04-05 (modified 2023-08-17) · logsource: product=windows category=registry_set · 396ae3eb-4174-4b9b-880e-dc0364d78a19

Detects the modification of Outlook setting "LoadMacroProviderOnBoot" which if enabled allows the automatic loading of any configured VBA project/module

Techniques: T1137 T1008 T1546

MSSQL Extended Stored Procedure Backdoor Maggie hightest

Author: Denis Szadkowski, DIRT / DCSO CyTec · 2022-10-09 · logsource: product=windows service=application · 711ab2fe-c9ba-4746-8840-5228a58c3cb8

This rule detects the execution of the extended storage procedure backdoor named Maggie in the context of Microsoft SQL server

Techniques: T1546

SOURGUM Actor Behaviours hightest

Author: MSTIC, FPT.EagleEye · 2021-06-15 (modified 2022-10-09) · logsource: product=windows category=process_creation · 7ba08e95-1e0b-40cd-9db5-b980555e42fd

Suspicious behaviours related to an actor tracked by Microsoft as SOURGUM

Techniques: T1546 T1546.015

New Outlook Macro Created mediumtest

Author: @ScoubiMtl · 2021-04-05 (modified 2023-02-08) · logsource: product=windows category=file_event · 8c31f563-f9a7-450c-bfa8-35f8f32f1f61

Detects the creation of a macro file for Outlook.

Techniques: T1137 T1008 T1546

HAFNIUM Exchange Exploitation Activity criticaltest

Author: Florian Roth (Nextron Systems) · 2021-03-09 (modified 2023-03-09) · logsource: product=windows category=process_creation · bbb2dedd-a0e3-46ab-ba6c-6c82ae7a9aa7

Detects activity observed by different researchers to be HAFNIUM group activity (or related) on Exchange servers

Techniques: T1546 T1053

Outlook Macro Execution Without Warning Setting Enabled hightest

Author: @ScoubiMtl · 2021-04-05 (modified 2023-08-17) · logsource: product=windows category=registry_set · e3b50fa5-3c3f-444e-937b-0a99d33731cd

Detects the modification of Outlook security setting to allow unprompted execution of macros.

Techniques: T1137 T1008 T1546

Sub-techniques

ID	Name	Sigma rules
T1546.001	Change Default File Association	5
T1546.002	Screensaver	4
T1546.003	Windows Management Instrumentation Event Subscription	12
T1546.004	Unix Shell Configuration Modification	1
T1546.005	Trap	0
T1546.006	LC_LOAD_DYLIB Addition	0
T1546.007	Netsh Helper DLL	4
T1546.008	Accessibility Features	6
T1546.009	AppCert DLLs	2
T1546.010	AppInit DLLs	1
T1546.011	Application Shimming	6
T1546.012	Image File Execution Options Injection	2
T1546.013	PowerShell Profile	3
T1546.014	Emond	1
T1546.015	Component Object Model Hijacking	9
T1546.016	Installer Packages	0
T1546.017	Udev Rules	0
T1546.018	Python Startup Hooks	0

T1546 Event Triggered Execution

KEV CVEs mapped to this technique · CTID Mappings Explorer

Detection strategy · ATT&CK Enterprise v19.2

Sigma rules · SigmaHQ da9bb07d64, tag attack.t1546

Sub-techniques

Sigma rules · SigmaHQ da9bb07d64, tag `attack.t1546`