Event Triggered Execution
- ID
- T1546
- Tactics
- TA0003 Persistence, TA0004 Privilege Escalation
- Platforms
- Linux, macOS, Windows, SaaS, IaaS, Office Suite
- Data sources
- Scheduled Job Creation, WMI Creation, Windows Registry Key Modification, Process Creation, File Metadata, Command Execution, File Modification, Cloud Service Modification, Script Execution, Network Traffic Content
- Source
- attack.mitre.org
- MITRE last modified
- 5 Aug 2026
Adversaries may establish persistence and/or elevate privileges using system mechanisms that trigger execution based on specific events. Various operating systems have means to monitor and subscribe to events such as logons or other user activity such as running specific applications/binaries. Cloud environments may also support various functions and services that monitor and can be invoked in response to specific cloud events.[1][2][3]
Adversaries may abuse these mechanisms as a means of maintaining persistent access to a victim via repeatedly executing malicious code. After gaining access to a victim system, adversaries may create/modify event triggers to point to malicious content that will be executed whenever the event trigger is invoked.[4][5][6]
Since the execution can be proxied by an account with higher permissions, such as SYSTEM or service accounts, an adversary may be able to abuse these triggered execution mechanisms to escalate their privileges.
Sub-techniques (18)
- T1546.001 Change Default File Association
- T1546.002 Screensaver
- T1546.003 Windows Management Instrumentation Event Subscription
- T1546.004 Unix Shell Configuration Modification
- T1546.005 Trap
- T1546.006 LC_LOAD_DYLIB Addition
- T1546.007 Netsh Helper DLL
- T1546.008 Accessibility Features
- T1546.009 AppCert DLLs
- T1546.010 AppInit DLLs
- T1546.011 Application Shimming
- T1546.012 Image File Execution Options Injection
- T1546.013 PowerShell Profile
- T1546.014 Emond
- T1546.015 Component Object Model Hijacking
- T1546.016 Installer Packages
- T1546.017 Udev Rules
- T1546.018 Python Startup Hooks
Detection
- DET0010 Behavioral Detection of Event Triggered Execution Across Platforms
Data components: Scheduled Job Creation, WMI Creation, Windows Registry Key Modification, Process Creation, File Metadata, Command Execution, File Modification, Cloud Service Modification, Script Execution, Network Traffic Content
Mitigations (2)
- M1026 Privileged Account Management
Manage the creation, modification, use, and permissions associated to privileged accounts, including SYSTEM and root.
- M1051 Update Software
Perform regular software updates to mitigate exploitation risk.