T1546 Event Triggered Execution
Adversaries may establish persistence and/or elevate privileges using system mechanisms that trigger execution based on specific events. Various operating systems have means to monitor and subscribe to events such as logons or other user activity such as running specific applications/binaries. Cloud environments may also support various functions and services that monitor and can be invoked in…
Who uses it · with stories on Jábega
Sigma rules to hunt it
- HAFNIUM Exchange Exploitation Activitycriticaltest · windows
- Persistence Via Sticky Key Backdoorcriticaltest · windows
- Sticky Key Like Backdoor Executioncriticaltest · windows
- Sticky Key Like Backdoor Usage - Registrycriticaltest · windows
- WMI Backdoor Exchange Transport Agentcriticaltest · windows
- COM Hijack via Sdclthightest · windows
- Change Default File Association To Executable Via Assochightest · windows
- Control Panel Itemshightest · windows
- MSSQL Extended Stored Procedure Backdoor Maggiehightest · windows
- New Netsh Helper DLL Registered From A Suspicious Locationhightest · windows
- NewActiveScriptEventConsumer Creation Attempt via Wmic.EXEhightest · windows
- Outlook Macro Execution Without Warning Setting Enabledhightest · windows
- Potential PSFactoryBuffer COM Hijackinghightest · windows
- Potential Persistence Via App Paths Default Propertyhightest · windows
- Potential Persistence Via GlobalFlagshightest · windows
- Potential Persistence Via Outlook LoadMacroProviderOnBoot Settinghightest · windows
- Potential Persistence Via Shim Database In Uncommon Locationhightest · windows
- Potential Privilege Escalation Using Symlink Between Osk and Cmdhightest · windows
- Rundll32 Registered COM Objectshightest · windows
- SOURGUM Actor Behaviourshightest · windows
- Shell Open Registry Keys Manipulationhightest · windows
- Suspicious Debugger Registration Cmdlinehightest · windows
- Suspicious Encoded Scripts in a WMI Consumerhightest · windows
- Suspicious Get-Variable.exe Creationhightest · windows
- Suspicious Outlook Macro Createdhightest · windows
Showing 25 of 62.
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.