Cross-source coverage

T1546 / ATT&CK

Event Triggered Execution

257 rules · 250 families across 9 sources.

1 deprecated hidden · include 1 atomic-IOC hidden · include

From MITRE ATT&CK 19.2

Adversaries may establish persistence and/or elevate privileges using system mechanisms that trigger execution based on specific events. Various operating systems have means to monitor and subscribe to events such as logons or other user activity such as running specific applications/binaries. Cloud environments may also support various functions and services that monitor and can be invoked in response to specific cloud events.

Adversaries may abuse these mechanisms as a means of maintaining persistent access to a victim via repeatedly executing malicious code. After gaining access to a victim system, adversaries may create/modify event triggers to point to malicious content that will be executed whenever the event trigger is invoked.

Since the execution can be proxied by an account with higher permissions, such as SYSTEM or service accounts, an adversary may be able to abuse these triggered execution mechanisms to escalate their privileges.

Platforms
Linux · macOS · Windows · SaaS · IaaS · Office Suite
Telemetry
WinEventLog:SecurityWinEventLog:WMIWinEventLog:Sysmonauditd:SYSCALLlinux:syslogmacos:unifiedlogAWS:CloudTrailm365:unifiedm365:office

How MITRE says to detect it DET0010

Behavioral Detection of Event Triggered Execution Across Platforms

Windows Analytic 0024

Correlates unexpected modifications to WMI event filters, scheduled task triggers, or registry autorun keys with subsequent execution of non-standard binaries by SYSTEM-level processes.

  • WinEventLog:Security EventCode=4698
  • WinEventLog:WMI Creation or modification of __EventFilter, __FilterToConsumerBinding, or CommandLineEventConsumer
  • WinEventLog:Security EventCode=4657
  • WinEventLog:Sysmon EventCode=1

Linux Analytic 0025

Detects inotify or auditd configuration changes that monitor system files coupled with execution of script interpreters or binaries by cron or systemd timers.

  • auditd:SYSCALL Inotify watch creation or auditctl changes on /etc/cron* or /lib/systemd/system/
  • linux:syslog Execution of non-standard script or binary by cron
  • auditd:SYSCALL Execution of script interpreters by systemd timer (ExecStart)

macOS Analytic 0026

Correlates launchd plist modifications with subsequent unauthorized script execution or anomalous parent-child process trees involving user agents.

  • macos:unifiedlog Modification of ~/Library/LaunchAgents or /Library/LaunchDaemons plist
  • macos:unifiedlog Execution of launchctl with suspicious arguments

IaaS Analytic 0027

Monitors cloud function creation triggered by specific audit log events (e.g., IAM changes, object creation), followed by anomalous behavior from new service accounts.

  • AWS:CloudTrail CreateFunction
  • AWS:CloudTrail InvokeFunction

SaaS Analytic 0028

Correlates Power Automate or similar logic app workflows triggered by SaaS file uploads or email rules with data forwarding or anomalous access patterns.

  • m365:unified Creation of Power Automate flow triggered by OneDrive or Exchange event
  • m365:unified Automated forwarding or file sync initiated by a logic app

Office Suite Analytic 0029

Detects macros or VBA triggers set to execute on document open or close events, often correlating with embedded payloads or C2 traffic shortly after execution.

  • m365:office VBA auto_open, auto_close, or document_open events
  • m365:office External HTTP/DNS connection from Office binary shortly after macro trigger

View on attack.mitre.org ↗

Sub-techniques with coverage

Counted in the 257 above — a rule tagged a sub-technique covers this technique too.

elastic/detection-rules

66 rules
Detection Severity Format
AWS Lambda Function Policy Updated to Allow Cross-Account Invocation High Elastic TOML
AWS Lambda Function Policy Updated to Allow Public Invocation High Elastic TOML
AWS SageMaker Notebook Lifecycle Configuration With Suspicious Script Content High Elastic TOML
Curl Execution via Shell Profile High Elastic TOML
Potential Modification of Accessibility Binaries High Elastic TOML
Suspicious Echo or Printf Execution Detected via Defend for Containers High Elastic TOML
Suspicious File Creation via Pkg Install Script High Elastic TOML
Bash Shell Profile Modification Medium Elastic TOML
Emond Rules Creation or Modification Medium Elastic TOML
Executable Bit Set for Potential Persistence Script Medium Elastic TOML

+ 56 more from elastic/detection-rules → showing the 10 highest-severity

SigmaHQ/sigma

64 rules
Detection Severity Format
HAFNIUM Exchange Exploitation Activity Critical Sigma
Persistence Via Sticky Key Backdoor Critical Sigma
Sticky Key Like Backdoor Execution Critical Sigma
Sticky Key Like Backdoor Usage - Registry Critical Sigma
WMI Backdoor Exchange Transport Agent Critical Sigma
Change Default File Association To Executable Via Assoc High Sigma
COM Hijack via Sdclt High Sigma
COM Object Hijacking Via Modification Of Default System CLSID Default Value High Sigma
Control Panel Items High Sigma
MSSQL Extended Stored Procedure Backdoor Maggie High Sigma

+ 54 more from SigmaHQ/sigma → showing the 10 highest-severity

socfortress/Wazuh-Rules

61 rules · 57 families
Detection Severity Format
Change Default File Association via \Explorer\FileExts (T1546.001) High Wazuh XML
Detects change of user environment. Adversaries can insert code into these files to gain persistence each time a user logs in or opens a new shell. 2 variants High Wazuh XML
Detects change of user environment. Adversaries can insert code into these files to gain persistence each time a user logs in or opens a new shell. 2 variants High Wazuh XML
Generic detection of bash trap command with signal and script (T1546.005) High Wazuh XML
Potential persistence via bash trap on SIGINT (CTRL+C) (T1546.005) High Wazuh XML
Powershell script: COM CLSID object execution detected High Wazuh XML
Powershell script: COM InProcServer32 hijacking detected High Wazuh XML
Sysmon - Event 12: RegistryEvent (Object create and delete) by · Registry Key Creation \(Persistence\) (T1546) High Wazuh XML
Sysmon - Event 13: RegistryEvent (Value Set) by · AutoRun Command Processor (T1546.002) High Wazuh XML
Sysmon - Event 13: RegistryEvent (Value Set) by · MSTSC ClxDllPath (T1546.006) High Wazuh XML

+ 51 more from socfortress/Wazuh-Rules → showing the 10 highest-severity

elastic/protections-artifacts

26 rules
Detection Severity Format
Binary Execution from Unusual Location through Shell Profile Undefined Elastic TOML
Component Object Model Registry Modification by a Low Reputation Process Undefined Elastic TOML
COM to .NET Redirection via Registry Undefined Elastic TOML
Egress Connection by a DNF Package Manager Descendant Undefined Elastic TOML
Egress Network Connection from Default DPKG Directory Undefined Elastic TOML
Egress Network Connection from RPM Package Undefined Elastic TOML
Initial Access Staging via Installer Package Undefined Elastic TOML
Less Pipe Backdoor Execution Undefined Elastic TOML
Potential Evasion via Stack Rumbling Undefined Elastic TOML
Potential Persistence via Emond Undefined Elastic TOML

+ 16 more from elastic/protections-artifacts → showing the 10 highest-severity

splunk/security_content

25 rules
Detection Severity Format
Detect WMI Event Subscription Persistence Undefined SPL
Linux Auditd Unix Shell Configuration Modification Undefined SPL
Linux File Creation In Profile Directory Undefined SPL
Linux Possible Append Command To Profile Config File Undefined SPL
Overwriting Accessibility Binaries Undefined SPL
Powershell COM Hijacking InprocServer32 Modification Undefined SPL
Powershell Execute COM Object Undefined SPL
Python PTH File Creation During Package Installation Undefined SPL
Python Site Hooks Creation During Package Installation Undefined SPL
Registry Keys for Creating SHIM Databases Undefined SPL

+ 15 more from splunk/security_content → showing the 10 highest-severity

Wazuh Core Ruleset

8 rules
Detection Severity Format
COM Hijacking evidence found in registry under suspicious binary is · win.eventdata.details = (?i)AppData Critical Wazuh XML
Possible Shimming. Application Compatibility Database launched from an encoded powershell command Critical Wazuh XML
WmiConsumerEvent created, possible persistence tactic using command-executing binaries Critical Wazuh XML
Application Compatibility Database launched High Wazuh XML
WmiConsumerEvent created, possible persistence tactic High Wazuh XML
An executable - - loaded from the Temp directory. · win.eventdata.imageLoaded = (?i)[c-z]:\\\\Windows\\\\Temp\\\\.+\.dll Medium Wazuh XML
Rundll32 executing suspicious .lock file, possible persistence tactic Medium Wazuh XML
Possible COM Hijacking evidence found in registry under binary is · win.eventdata.targetObject = (?i)CLSID.*LocalServer Low Wazuh XML

Azure/Azure-Sentinel

3 rules
Detection Severity Format
SUNBURST and SUPERNOVA backdoor hashes (Normalized File Events) High KQL
Modification of Accessibility Features Medium KQL
detect-impacket-wmipersist Undefined KQL

falcosecurity/rules

2 rules
Detection Severity Format
Modify Shell Configuration File Medium Falco YAML
Read Shell Configuration File Medium Falco YAML

panther-labs/panther-analysis

2 rules
Detection Severity Format
Kubernetes Admission Controller Webhook Created Medium Panther Python
Azure Automation Webhook Created Informational Panther Python

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.