T1546 Event Triggered Execution Mappings

Adversaries may establish persistence and/or elevate privileges using system mechanisms that trigger execution based on specific events. Various operating systems have means to monitor and subscribe to events such as logons or other user activity such as running specific applications/binaries. Cloud environments may also support various functions and services that monitor and can be invoked in response to specific cloud events.(Citation: Backdooring an AWS account)(Citation: Varonis Power Automate Data Exfiltration)(Citation: Microsoft DART Case Report 001)

Adversaries may abuse these mechanisms as a means of maintaining persistent access to a victim via repeatedly executing malicious code. After gaining access to a victim system, adversaries may create/modify event triggers to point to malicious content that will be executed whenever the event trigger is invoked.(Citation: FireEye WMI 2015)(Citation: Malware Persistence on OS X)(Citation: amnesia malware)

Since the execution can be proxied by an account with higher permissions, such as SYSTEM or service accounts, an adversary may be able to abuse these triggered execution mechanisms to escalate their privileges.

View in MITRE ATT&CK®

Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name
CM-02 Baseline Configuration Protects T1546 Event Triggered Execution
CM-06 Configuration Settings Protects T1546 Event Triggered Execution
IA-09 Service Identification and Authentication Protects T1546 Event Triggered Execution
SI-07 Software, Firmware, and Information Integrity Protects T1546 Event Triggered Execution
PUR-IP-E5 Information Protection Technique Scores T1546 Event Triggered Execution
PUR-AS-E5 Audit Solutions Technique Scores T1546 Event Triggered Execution
DEF-SecScore-E3 Secure Score Technique Scores T1546 Event Triggered Execution
DO365-ATH-E5 Advanced Threat Hunting Technique Scores T1546 Event Triggered Execution

ATT&CK Subtechniques

Technique ID Technique Name Number of Mappings
T1546.013 PowerShell Profile 10
T1546.006 LC_LOAD_DYLIB Addition 14
T1546.011 Application Shimming 2
T1546.008 Accessibility Features 6
T1546.009 AppCert DLLs 3
T1546.003 Windows Management Instrumentation Event Subscription 12
T1546.014 Emond 6
T1546.004 Unix Shell Configuration Modification 8
T1546.010 AppInit DLLs 5
T1546.002 Screensaver 9
T1546.016 Installer Packages 7