1. Home
  2. ATT&CK Techniques
  3. T1546 Event Triggered Execution

T1546 Event Triggered Execution

Adversaries may establish persistence and/or elevate privileges using system mechanisms that trigger execution based on specific events. Various operating systems have means to monitor and subscribe to events such as logons or other user activity such as running specific applications/binaries. Cloud environments may also support various functions and services that monitor and can be invoked in response to specific cloud events.(Citation: Backdooring an AWS account)(Citation: Varonis Power Automate Data Exfiltration)(Citation: Microsoft DART Case Report 001)

Adversaries may abuse these mechanisms as a means of maintaining persistent access to a victim via repeatedly executing malicious code. After gaining access to a victim system, adversaries may create/modify event triggers to point to malicious content that will be executed whenever the event trigger is invoked.(Citation: FireEye WMI 2015)(Citation: Malware Persistence on OS X)(Citation: amnesia malware)

Since the execution can be proxied by an account with higher permissions, such as SYSTEM or service accounts, an adversary may be able to abuse these triggered execution mechanisms to escalate their privileges.

View in MITRE ATT&CK®

CRI Profile Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
PR.AA-05.02 Privileged system access Mitigates T1546 Event Triggered Execution
Comments
This diagnostic statement protects against Event Triggered Execution through the use of privileged account management and the use of multi-factor authentication.
References
    PR.PS-02.01 Patch identification and application Mitigates T1546 Event Triggered Execution
    Comments
    This diagnostic statement is related to the implementation of a patch management program. Applying patches and upgrades for products and systems provided by vendors mitigates the risk of adversaries exploiting known vulnerabilities. For example, performing regular software updates can mitigate potential event triggered execution exploitation risks.
    References
      PR.PS-01.03 Configuration deviation Mitigates T1546 Event Triggered Execution
      Comments
      This diagnostic statement provides protection from Event Triggered Execution through the implementation of security configuration baselines for OS, software, file integrity monitoring and imaging. Security baselining and integrity checking can help protect against adversaries attempting to compromise and modify software and its configurations.
      References
        PR.IR-01.03 Network communications integrity and availability Mitigates T1546 Event Triggered Execution
        Comments
        This diagnostic statement protects against Event Triggered Execution through the use of secure network configurations, architecture, implementations of zero trust architecture, and segmentation.
        References
          PR.IR-01.05 Remote access protection Mitigates T1546 Event Triggered Execution
          Comments
          This diagnostic statement implements security controls and restrictions for remote user access to systems. Remote user access control involves managing and securing how users remotely access systems, such as through encrypted connections and account use policies, which help prevent adversary access.
          References
            PR.IR-01.06 Production environment segregation Mitigates T1546 Event Triggered Execution
            Comments
            This diagnostic statement provides protections for production environments. Measures such as network segmentation and access control reduce the attack surface, restrict movement by adversaries, and protect critical assets and data from compromise.
            References
              PR.AA-01.01 Identity and credential management Mitigates T1546 Event Triggered Execution
              Comments
              This diagnostic statement protects against Event Triggered Execution through the use of hardened access control policies, secure defaults, password complexity requirements, multifactor authentication requirements, and removal of terminated accounts.
              References
                PR.PS-01.08 End-user device protection Mitigates T1546 Event Triggered Execution
                Comments
                This diagnostic statement protects against Event Triggered Execution through the use of limiting access to resources to only authorized devices, management of personal computing devices, network intrusion prevention, and the use of antimalware.
                References

                  NIST 800-53 Mappings

                  Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
                  CM-06 Configuration Settings mitigates T1546 Event Triggered Execution
                  IA-09 Service Identification and Authentication mitigates T1546 Event Triggered Execution
                  SI-02 Flaw Remediation mitigates T1546 Event Triggered Execution
                  SI-07 Software, Firmware, and Information Integrity mitigates T1546 Event Triggered Execution
                  CM-02 Baseline Configuration mitigates T1546 Event Triggered Execution
                  AC-02 Account Management mitigates T1546 Event Triggered Execution
                  AC-03 Access Enforcement mitigates T1546 Event Triggered Execution
                  AC-06 Least Privilege mitigates T1546 Event Triggered Execution
                  CM-03 Configuration Change Control mitigates T1546 Event Triggered Execution

                  VERIS Mappings

                  Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
                  action.hacking.variety.Backdoor Hacking action that creates a backdoor for use. related-to T1546 Event Triggered Execution
                  action.hacking.variety.XML injection XML injection. Child of 'Exploit vuln'. related-to T1546 Event Triggered Execution
                  action.hacking.vector.Backdoor Hacking actions taken through a backdoor. C2 is only used by malware. related-to T1546 Event Triggered Execution
                  action.malware.variety.Backdoor Malware creates a backdoor capability for hacking. Child of 'RAT' when combined with 'Trojan'. Child of 'Backdoor or C2'. related-to T1546 Event Triggered Execution
                  action.malware.variety.Backdoor or C2 Malware creates a remote control capability, but it's unclear if it's a backdoor for hacking or C2 for malware. Parent of 'C2' and 'Backdoor'. related-to T1546 Event Triggered Execution
                  attribute.integrity.variety.Alter behavior Influence or alter human behavior related-to T1546 Event Triggered Execution

                  Azure Mappings

                  Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
                  file_integrity_monitoring Microsoft Defender for Cloud: File Integrity Monitoring technique_scores T1546 Event Triggered Execution
                  Comments
                  The detection score for this technique was assessed as Partial because it doesn't detect some of the sub-techniques of this technique such as Windows Management Instrumentation (WMI) Event Subscription and Trap sub-techniques. Additionally for some sub-techniques, this control can be noisy.
                  References
                  1. https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview
                  ai_security_recommendations Microsoft Defender for Cloud: AI Security Recommendations technique_scores T1546 Event Triggered Execution
                  Comments
                  This control's "Immutable (read-only) root filesystem should be enforced for containers" recommendation can mitigate a sub-technique of this technique. Due to its Minimal coverage, its score is assessed as Minimal.
                  References
                  1. https://learn.microsoft.com/en-us/azure/defender-for-cloud/recommendations-reference-ai
                  alerts_for_windows_machines Alerts for Windows Machines technique_scores T1546 Event Triggered Execution
                  Comments
                  This control's detection is specific to a minority of this technique's sub-techniques resulting in a Minimal Coverage score and consequently an overall score of Minimal.
                  References
                  1. https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers
                  2. https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines

                  GCP Mappings

                  Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
                  google_secops Google Security Operations technique_scores T1546 Event Triggered Execution
                  Comments
                  Google Security Ops is able to trigger an alert based on manipulation of default programs. This technique was scored as minimal based on low or uncertain detection coverage factor. https://github.com/chronicle/detection-rules/blob/783e0e5947774785db1c55041b70176deeca6f46/mitre_attack/T1546_001_windows_change_default_file_association.yaral
                  References
                  1. ['https://cloud.google.com/security/products/security-operations'
                  2. 'https://cloud.google.com/chronicle/docs/secops/secops-overview'
                  3. 'https://github.com/chronicle/detection-rules']

                  ATT&CK Subtechniques

                  Technique ID Technique Name Number of Mappings
                  T1546.013 PowerShell Profile 16
                  T1546.006 LC_LOAD_DYLIB Addition 17
                  T1546.011 Application Shimming 6
                  T1546.005 Trap 1
                  T1546.012 Image File Execution Options Injection 2
                  T1546.008 Accessibility Features 16
                  T1546.009 AppCert DLLs 6
                  T1546.003 Windows Management Instrumentation Event Subscription 18
                  T1546.001 Change Default File Association 4
                  T1546.014 Emond 8
                  T1546.004 Unix Shell Configuration Modification 11
                  T1546.015 Component Object Model Hijacking 2
                  T1546.010 AppInit DLLs 8
                  T1546.002 Screensaver 12
                  T1546.016 Installer Packages 10
                  T1546.017 Udev Rules 6
                  T1546.007 Netsh Helper DLL 3