T1546PersistencePrivilege Escalation
Event Triggered Execution
Adversaries may establish persistence and/or elevate privileges using system mechanisms that trigger execution based on specific events. Various operating systems have means to monitor and subscribe to events such as logons or other user activity such as running specific applications/binaries. Cloud environments may also support various functions and services that monitor and can be invoked in…
CVEs0
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.0
Reports0
Detections
10 Sigma rules tagged T1546Event Triggered ExecutionT154610 general rules
- HAFNIUM Exchange Exploitation Activitycriticaltest
- COM Hijack via Sdclthightest
- Control Panel Itemshightest
- MSSQL Extended Stored Procedure Backdoor Maggiehightest
- Outlook Macro Execution Without Warning Setting Enabledhightest
- Potential Persistence Via Outlook LoadMacroProviderOnBoot Settinghightest
- SOURGUM Actor Behaviourshightest
- Suspicious Get-Variable.exe Creationhightest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Event Triggered Execution
0 CVEs, by priority. Each link shows its badge.No CVEs are linked to this technique yet.