Event Triggered Execution

T1546

Technique with 18 sub-techniques.View on attack.mitre.org

About this technique

Adversaries may establish persistence and/or elevate privileges using system mechanisms that trigger execution based on specific events. Various operating systems have means to monitor and subscribe to events such as logons or other user activity such as running specific applications/binaries. Cloud environments may also support various functions and services that monitor and can be invoked in response to specific cloud events.

Adversaries may abuse these mechanisms as a means of maintaining persistent access to a victim via repeatedly executing malicious code. After gaining access to a victim system, adversaries may create/modify event triggers to point to malicious content that will be executed whenever the event trigger is invoked.

Since the execution can be proxied by an account with higher permissions, such as SYSTEM or service accounts, an adversary may be able to abuse these triggered execution mechanisms to escalate their privileges.

Detection rules88

Rules on DetectionCode tagged with T1546 or one of its sub-techniques.

Sigma60

Rule	Level	Log source	Technique
Persistence Via Sticky Key Backdoor	critical	windows / process_creation	T1546.008
Sticky Key Like Backdoor Execution	critical	windows / process_creation	T1546.008
Sticky Key Like Backdoor Usage - Registry	critical	windows / registry_event	T1546.008
WMI Backdoor Exchange Transport Agent	critical	windows / process_creation	T1546.003
Change Default File Association To Executable Via Assoc	high	windows / process_creation	T1546.001
COM Hijack via Sdclt	high	windows / registry_set	T1546
COM Object Hijacking Via Modification Of Default System CLSID Default Value	high	windows / registry_set	T1546.015
Control Panel Items	high	windows / process_creation	T1546
New Netsh Helper DLL Registered From A Suspicious Location	high	windows / registry_set	T1546.007
NewActiveScriptEventConsumer Creation Attempt via Wmic.EXE	high	windows / process_creation	T1546.003
Outlook Macro Execution Without Warning Setting Enabled	high	windows / registry_set	T1546
Potential Persistence Via App Paths Default Property	high	windows / registry_set	T1546.012
Potential Persistence Via GlobalFlags	high	windows / registry_set	T1546.012
Potential Persistence Via Outlook LoadMacroProviderOnBoot Setting	high	windows / registry_set	T1546
Potential Persistence Via Shim Database In Uncommon Location	high	windows / registry_set	T1546.011
Potential Privilege Escalation Using Symlink Between Osk and Cmd	high	windows / process_creation	T1546.008
Potential PSFactoryBuffer COM Hijacking	high	windows / registry_set	T1546.015
Rundll32 Registered COM Objects	high	windows / process_creation	T1546.015
Shell Open Registry Keys Manipulation	high	windows / registry_event	T1546.001
Suspicious Debugger Registration Cmdline	high	windows / process_creation	T1546.008
Suspicious Encoded Scripts in a WMI Consumer	high	windows / wmi_event	T1546.003
Suspicious Get-Variable.exe Creation	high	windows / file_event	T1546
Suspicious Outlook Macro Created	high	windows / file_event	T1546
Suspicious Shim Database Patching Activity	high	windows / registry_set	T1546.011
WMI Persistence - Command Line Event Consumer	high	windows / image_load	T1546.003
WMI Persistence - Script Event Consumer File Write	high	windows / file_event	T1546.003
COM Hijacking via TreatAs	medium	windows / registry_set	T1546.015
MacOS Emond Launch Daemon	medium	macos / file_event	T1546.014
New DLL Added to AppCertDlls Registry Key	medium	windows / registry_event	T1546.009
New DLL Added to AppInit_DLLs Registry Key	medium	windows / registry_event	T1546.010
New Outlook Macro Created	medium	windows / file_event	T1546
Path To Screensaver Binary Modified	medium	windows / registry_event	T1546.002
Potential COM Object Hijacking Via TreatAs Subkey - Registry	medium	windows / registry_set	T1546.015
Potential Persistence Using DebugPath	medium	windows / registry_set	T1546.015
Potential Persistence Via AppCompat RegisterAppRestart Layer	medium	windows / registry_set	T1546.011
Potential Persistence Via Netsh Helper DLL	medium	windows / process_creation	T1546.007
Potential Persistence Via Netsh Helper DLL - Registry	medium	windows / registry_set	T1546.007
Potential Persistence Via PowerShell User Profile Using Add-Content	medium	windows / ps_script	T1546.013
Potential Persistence Via Scrobj.dll COM Hijacking	medium	windows / registry_set	T1546.015
Potential Persistence Via Shim Database Modification	medium	windows / registry_set	T1546.011
Potential Shim Database Persistence via Sdbinst.EXE	medium	windows / process_creation	T1546.011
Potential Suspicious Activity Using SeCEdit	medium	windows / process_creation	T1546.007 T1546.008
PowerShell Profile Modification	medium	windows / file_event	T1546.013
Powershell WMI Persistence	medium	windows / ps_script	T1546.003
Registry Modification of MS-settings Protocol Handler	medium	windows / process_creation	T1546.001
Session Manager Autorun Keys Modification	medium	windows / registry_set	T1546.009
Suspicious GetTypeFromCLSID ShellExecute	medium	windows / ps_script	T1546.015
Suspicious ScreenSave Change by Reg.exe	medium	windows / process_creation	T1546.002
Suspicious Screensaver Binary File Creation	medium	windows / file_event	T1546.002
Suspicious Shell Open Command Registry Modification	medium	windows / registry_set	T1546.001
Uncommon Extension Shim Database Installation Via Sdbinst.EXE	medium	windows / process_creation	T1546.011
Unix Shell Configuration Modification	medium	linux / NULL	T1546.004
VsCode Powershell Profile Modification	medium	windows / file_event	T1546.013
WMI ActiveScriptEventConsumers Activity Via Scrcons.EXE DLL Load	medium	windows / image_load	T1546.003
WMI Event Subscription	medium	windows / wmi_event	T1546.003
WMI Persistence	medium	windows / NULL	T1546.003
WMI Persistence - Script Event Consumer	medium	windows / process_creation	T1546.003
WMI Persistence - Security	medium	windows / NULL	T1546.003
Writing Local Admin Share	medium	windows / file_event	T1546.002
Change Default File Association Via Assoc	low	windows / process_creation	T1546.001

Splunk28

Rule	Type	Risk	Data source	Technique
Change Default File Association	TTP	NULL	Sysmon EventID 12, Sysmon EventID 13	T1546.001
Detect WMI Event Subscription Persistence	TTP	NULL	Sysmon EventID 20	T1546.003
Linux Auditd Unix Shell Configuration Modification	TTP	NULL	Linux Auditd Path, Linux Auditd Cwd	T1546.004
Linux File Creation In Profile Directory	Anomaly	NULL	Sysmon for Linux EventID 11	T1546.004
Linux Possible Append Command To Profile Config File	Anomaly	NULL	Sysmon for Linux EventID 1	T1546.004
Overwriting Accessibility Binaries	TTP	NULL	Sysmon EventID 11	T1546.008
Powershell COM Hijacking InprocServer32 Modification	TTP	NULL	Powershell Script Block Logging 4104	T1546.015
Powershell Execute COM Object	TTP	NULL	Powershell Script Block Logging 4104	T1546.015
Python PTH File Creation During Package Installation	Anomaly	NULL	Sysmon EventID 1 AND Sysmon EventID 11	T1546
Python Site Hooks Creation During Package Installation	TTP	NULL	Sysmon EventID 1 AND Sysmon EventID 11	T1546
Registry Keys for Creating SHIM Databases	TTP	NULL	Sysmon EventID 13	T1546.011
Registry Keys Used For Privilege Escalation	TTP	NULL	Sysmon EventID 13	T1546.012
Screensaver Event Trigger Execution	TTP	NULL	Sysmon EventID 13	T1546.002
Shim Database File Creation	TTP	NULL	Sysmon EventID 11	T1546.011
Shim Database Installation With Suspicious Parameters	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1546.011
Suspicious Changes to File Associations	TTP	NULL	Sysmon EventID 1	T1546.001
Windows AD AdminSDHolder ACL Modified	TTP	NULL	Windows Event Log Security 5136	T1546
Windows AppCertDLL Modification Via Command Line	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1546.009
Windows AppCertDLL Modification Via Registry	Anomaly	NULL	Sysmon EventID 13	T1546.009
Windows Change Default File Association For No File Ext	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1546.001
Windows Change File Association Command To Notepad	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1546.001
Windows COM Hijacking InprocServer32 Modification	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1546.015
Windows Compatibility Telemetry Suspicious Child Process	TTP	NULL	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1546
Windows Compatibility Telemetry Tampering Through Registry	TTP	NULL	Sysmon EventID 13	T1546
Windows Event Triggered Image File Execution Options Injection	Hunting	NULL	Windows Event Log Application 3000	T1546.012
Windows MOF Event Triggered Execution via WMI	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1546.003
Windows New Default File Association Value Set	Hunting	NULL	Sysmon EventID 13	T1546.001
WMI Permanent Event Subscription - Sysmon	TTP	NULL	Sysmon EventID 21	T1546.003

Sub-techniques18

ID	Name	Examples
T1546.001	Change Default File Association	2
T1546.002	Screensaver	1
T1546.003	Windows Management Instrumentation Event Subscription	25
T1546.004	Unix Shell Configuration Modification	7
T1546.005	Trap	0
T1546.006	LC_LOAD_DYLIB Addition	0
T1546.007	Netsh Helper DLL	1
T1546.008	Accessibility Features	7
T1546.009	AppCert DLLs	1
T1546.010	AppInit DLLs	4
T1546.011	Application Shimming	4
T1546.012	Image File Execution Options Injection	3
T1546.013	PowerShell Profile	1
T1546.014	Emond	0
T1546.015	Component Object Model Hijacking	12
T1546.016	Installer Packages	5
T1546.017	Udev Rules	1
T1546.018	Python Startup Hooks	2

Groups0

None recorded.

Software4

Campaigns1

KV Botnet Activity

Procedure examples5

Software4

Used by	Procedure example
MalwareMini Shai-Hulud	Mini Shai-Hulud has modified settings and configuration files of AI coding agents and other coding applications in order to create event triggered executions through creating hooks and runOn conditions. Flashpoint Mini Shai-Hulud MAY 2026
ToolPacu	Pacu can set up S3 bucket notifications to trigger a malicious Lambda function when a CloudFormation template is uploaded to the bucket. It can also create Lambda functions that trigger upon the creation of users, roles, and groups. GitHub Pacu
MalwareUPSTYLE	UPSTYLE creates a `.pth` file beginning with the text `import` so that any time another process or script attempts to reference the modified item the malicious code will also run. Volexity UPSTYLE 2024
MalwareXCSSET	XCSSET's `dfhsebxzod` module searches for `.xcodeproj` directories within the user’s home folder and subdirectories. For each match, it locates the corresponding `project.pbxproj` file and embeds an encoded payload into a build rule, target configuration, or project setting. The payload is later executed during the build process. April 2021 TrendMicro XCSSET Microsoft March 2025 XCSSET

Campaigns1

Used by	Procedure example
CampaignKV Botnet Activity	KV Botnet Activity involves managing events on victim systems via `libevent` to execute a callback function when any running process contains the following references in their path without also having a reference to `bioset`: busybox, wget, curl, tftp, telnetd, or lua. If the `bioset` string is not found, the related process is terminated. Lumen KVBotnet 2023

References6

Backdooring an AWS account Open source
Daniel Grzelak. (2016, July 9). Backdooring an AWS account. Retrieved May 27, 2022.
FireEye WMI 2015 Open source
Ballenthin, W., et al. (2015). Windows Management Instrumentation (WMI) Offense, Defense, and Forensics. Retrieved March 30, 2016.
Malware Persistence on OS X Open source
Patrick Wardle. (2015). Malware Persistence on OS X Yosemite. Retrieved July 10, 2017.
Microsoft DART Case Report 001 Open source
Berk Veral. (2020, March 9). Real-life cybercrime stories from DART, the Microsoft Detection and Response Team. Retrieved May 27, 2022.
Varonis Power Automate Data Exfiltration Open source
Eric Saraga. (2022, February 2). Using Power Automate for Covert Data Exfiltration in Microsoft 365. Retrieved May 27, 2022.
amnesia malware Open source
Claud Xiao, Cong Zheng, Yanhui Jia. (2017, April 6). New IoT/Linux Malware Targets DVRs, Forms Botnet. Retrieved February 19, 2018.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.