LiveActive security incident?Get immediate response
MITRE ATT&CK® Technique

T1546: Event Triggered Execution

Adversaries may establish persistence and/or elevate privileges using system mechanisms that trigger execution based on specific events. Various operating systems have means to monitor and subscribe to events such as logons or other user activity such as running specific applications/binaries. Cloud environments may also support various functions and services that monitor and can be invoked in response to specific cloud events.[1][2][3]

Adversaries may abuse these mechanisms as a means of maintaining persistent access to a victim via repeatedly executing malicious code. After gaining access to a victim system, adversaries may create/modify event triggers to point to malicious content that will be executed whenever the event trigger is invoked.[4][5][6]

Since the execution can be proxied by an account with higher permissions, such as SYSTEM or service accounts, an adversary may be able to abuse these triggered execution mechanisms to escalate their privileges.

EnterpriseT1546TechniqueObject v1.4Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

T1546: Event Triggered Execution describes Adversaries may establish persistence and/or elevate privileges using system mechanisms that trigger execution based on specific events. Various operating systems have means to monitor and subscribe to events such as logons or other user activity such as running specific applications/binaries. Cloud environments may also support various functions and services that monitor and can be invoked in response to specific cloud events.(Citation: Backdooring an AWS account)(Citation: Varonis Power Automate Data Exfiltration...

Executive priority

T1546: Event Triggered Execution is an official MITRE ATT&CK technique. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.

Technical view

Security teams should validate T1546: Event Triggered Execution by reviewing the official ATT&CK relationships, mapped tactics (privilege-escalation, persistence), supported platforms (Linux, macOS, Windows, SaaS), and available local telemetry before making detection or mitigation decisions.

Likely telemetry

  • Official ATT&CK relationships and object metadata
  • Identity, privilege, and authentication events
  • Cloud control-plane, SaaS audit, and container platform logs
  • Network, endpoint, and security-tool telemetry

Detection direction

  • Validate whether T1546: Event Triggered Execution appears in your detection coverage and tabletop scenarios.
  • Use the object to align executive risk language with SOC, incident response, and detection engineering work.
  • Do not treat ATT&CK relationship context as attribution without corroborating evidence.

Mitigation priorities

  • Map the object to existing controls and identify missing telemetry or response ownership.
  • Prioritize mitigations that reduce exposure on the listed platforms and tactics.
  • Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.
Additional notes and limits

Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.

This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Event Triggered Execution

Adversaries may establish persistence and/or elevate privileges using system mechanisms that trigger execution based on specific events. Various operating systems have means to monitor and subscribe to events such as logons or other user activity such as running specific applications/binaries. Cloud environments may also support various functions and services that monitor and can be invoked in response to specific cloud events.[1][2][3]

Adversaries may abuse these mechanisms as a means of maintaining persistent access to a victim via repeatedly executing malicious code. After gaining access to a victim system, adversaries may create/modify event triggers to point to malicious content that will be executed whenever the event trigger is invoked.[4][5][6]

Since the execution can be proxied by an account with higher permissions, such as SYSTEM or service accounts, an adversary may be able to abuse these triggered execution mechanisms to escalate their privileges.

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Related techniques

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

18 rows
DomainIDNameRelationship / procedure
EnterpriseT1546.002ScreensaverSub-techniqueScreensaver subtechnique of this object.
EnterpriseT1546.013PowerShell ProfileSub-techniquePowerShell Profile subtechnique of this object.
EnterpriseT1546.016Installer PackagesSub-techniqueInstaller Packages subtechnique of this object.
EnterpriseT1546.003Windows Management Instrumentation Event SubscriptionSub-techniqueWindows Management Instrumentation Event Subscription subtechnique of this object.
EnterpriseT1546.006LC_LOAD_DYLIB AdditionSub-techniqueLC_LOAD_DYLIB Addition subtechnique of this object.
EnterpriseT1546.018Python Startup HooksSub-techniquePython Startup Hooks subtechnique of this object.
EnterpriseT1546.011Application ShimmingSub-techniqueApplication Shimming subtechnique of this object.
EnterpriseT1546.015Component Object Model HijackingSub-techniqueComponent Object Model Hijacking subtechnique of this object.
EnterpriseT1546.004Unix Shell Configuration ModificationSub-techniqueUnix Shell Configuration Modification subtechnique of this object.
EnterpriseT1546.010AppInit DLLsSub-techniqueAppInit DLLs subtechnique of this object.
EnterpriseT1546.005TrapSub-techniqueTrap subtechnique of this object.
EnterpriseT1546.007Netsh Helper DLLSub-techniqueNetsh Helper DLL subtechnique of this object.
EnterpriseT1546.012Image File Execution Options InjectionSub-techniqueImage File Execution Options Injection subtechnique of this object.
EnterpriseT1546.001Change Default File AssociationSub-techniqueChange Default File Association subtechnique of this object.
EnterpriseT1546.009AppCert DLLsSub-techniqueAppCert DLLs subtechnique of this object.
EnterpriseT1546.017Udev RulesSub-techniqueUdev Rules subtechnique of this object.
EnterpriseT1546.014EmondSub-techniqueEmond subtechnique of this object.
EnterpriseT1546.008Accessibility FeaturesSub-techniqueAccessibility Features subtechnique of this object.
Associated objects

Groups, software, and campaigns

ToolEnterprise

S1091: Pacu

Pacu is an open-source AWS exploitation framework. The tool is written in Python and publicly available on GitHub.[1]

IaaS
MalwareEnterprise

S1164: UPSTYLE

UPSTYLE is a Python-based backdoor associated with exploitation of Palo Alto firewalls using CVE-2024-3400 in early 2024. UPSTYLE has only been observed in relation to this exploitation activity, which involved attempted install on compromised devices by the threat actor UTA0218.[1][2]

Network DevicesLinux
MalwareEnterprise

S0658: XCSSET

XCSSET is a modular macOS malware family delivered through infected Xcode projects and executed when the project is compiled. Active since August 2020, it has been observed installing backdoors, spoofed browsers, collecting data, and encrypting user files. It is composed of SHC-compiled shell scripts and run-only AppleScripts, often hiding in apps that mimic system tools (such as Xcode, Mail, or Notes) or use familiar icons (like Launchpad) to avoid detection.[1][2][3]

macOS
MalwareEnterprise

S9043: Mini Shai-Hulud

Mini Shai-Hulud is a credential stealer and self-replicating supply chain worm, derived from Shai-Hulud, that has been used by TeamPCP to target Continuous Integration and Continuous Delivery/Deployment (CI/CD) workflows since at least 2026. Mini Shai-Hulud can compromise credentials across multiple cloud, container, and AI configuration file paths and can use stolen npm and GitHub OIDC tokens to spread to other packages maintained by the compromised user. Mini Shai-Hulud also has a targeted wiper component and has used multiple C2 and data exfiltration mechanisms.[1][2][3][4][5][6]

ContainersIaaSLinux
CampaignEnterprise

C0035: KV Botnet Activity

KV Botnet Activity consisted of exploitation of primarily “end-of-life” small office-home office (SOHO) equipment from manufacturers such as Cisco, NETGEAR, and DrayTek. KV Botnet Activity was used by Volt Typhoon to obfuscate connectivity to victims in multiple critical infrastructure segments, including energy and telecommunication companies and entities based on the US territory of Guam. While the KV Botnet is the most prominent element of this campaign, it overlaps with another botnet cluster referred to as the JDY cluster.[1] This botnet was disrupted by US law enforcement entities in early 2024 after periods of activity from October 2022 through January 2024.[2]

Relationship explorer

All related ATT&CK context

subtechnique of · TechniqueT1546.002: ScreensaverEnterprisesubtechnique of · TechniqueT1546.013: PowerShell ProfileEnterprisesubtechnique of · TechniqueT1546.016: Installer PackagesEnterprisesubtechnique of · TechniqueT1546.003: Windows Management Instrumentation Event SubscriptionEnterprisesubtechnique of · TechniqueT1546.006: LC_LOAD_DYLIB AdditionEnterprisesubtechnique of · TechniqueT1546.018: Python Startup HooksEnterprisesubtechnique of · TechniqueT1546.011: Application ShimmingEnterprisesubtechnique of · TechniqueT1546.015: Component Object Model HijackingEnterprisesubtechnique of · TechniqueT1546.004: Unix Shell Configuration ModificationEnterprisesubtechnique of · TechniqueT1546.010: AppInit DLLsEnterprisesubtechnique of · TechniqueT1546.005: TrapEnterpriseuses · ToolS1091: PacuEnterprisesubtechnique of · TechniqueT1546.007: Netsh Helper DLLEnterprisesubtechnique of · TechniqueT1546.012: Image File Execution Options InjectionEnterprisesubtechnique of · TechniqueT1546.001: Change Default File AssociationEnterprisemitigates · MitigationM1026: Privileged Account ManagementEnterprisesubtechnique of · TechniqueT1546.009: AppCert DLLsEnterpriseuses · CampaignC0035: KV Botnet ActivityEnterprisesubtechnique of · TechniqueT1546.017: Udev RulesEnterpriseuses · MalwareS1164: UPSTYLEEnterprisesubtechnique of · TechniqueT1546.014: EmondEnterprisesubtechnique of · TechniqueT1546.008: Accessibility FeaturesEnterprisedetects · Detection StrategyDET0010: Behavioral Detection of Event Triggered Execution Across PlatformsEnterpriseuses · MalwareS0658: XCSSETEnterprise
Mitigations

Mitigation direction

MitigationEnterprise

M1026: Privileged Account Management

Privileged Account Management focuses on implementing policies, controls, and tools to securely manage privileged accounts (e.g., SYSTEM, root, or administrative accounts). This includes restricting access, limiting the scope of permissions, monitoring privileged account usage, and ensuring accountability through logging and auditing.This mitigation can be implemented through the following measures:

Account Permissions and Roles:

- Implement RBAC and least privilege principles to allocate permissions securely. - Use tools like Active Directory Group Policies to enforce access restrictions.

Credential Security:

- Deploy password vaulting tools like CyberArk, HashiCorp Vault, or KeePass for secure storage and rotation of credentials. - Enforce password policies for complexity, uniqueness, and expiration using tools like Microsoft Group Policy Objects (GPO).

Multi-Factor Authentication (MFA):

- Enforce MFA for all privileged accounts using Duo Security, Okta, or Microsoft Azure AD MFA.

Privileged Access Management (PAM):

- Use PAM solutions like CyberArk, BeyondTrust, or Thycotic to manage, monitor, and audit privileged access.

Auditing and Monitoring:

- Integrate activity monitoring into your SIEM (e.g., Splunk or QRadar) to detect and alert on anomalous privileged account usage.

Just-In-Time Access:

- Deploy JIT solutions like Azure Privileged Identity Management (PIM) or configure ephemeral roles in AWS and GCP to grant time-limited elevated permissions.

*Tools for Implementation*

Privileged Access Management (PAM):

- CyberArk, BeyondTrust, Thycotic, HashiCorp Vault.

Credential Management:

- Microsoft LAPS (Local Admin Password Solution), Password Safe, HashiCorp Vault, KeePass.

Multi-Factor Authentication:

- Duo Security, Okta, Microsoft Azure MFA, Google Authenticator.

Linux Privilege Management:

- sudo configuration, SELinux, AppArmor.

Just-In-Time Access:

- Azure Privileged Identity Management (PIM), AWS IAM Roles with session constraints, GCP Identity-Aware Proxy.

MitigationEnterprise

M1051: Update Software

Software updates ensure systems are protected against known vulnerabilities by applying patches and upgrades provided by vendors. Regular updates reduce the attack surface and prevent adversaries from exploiting known security gaps. This includes patching operating systems, applications, drivers, and firmware. This mitigation can be implemented through the following measures:

Regular Operating System Updates

- Implementation: Apply the latest Windows security updates monthly using WSUS (Windows Server Update Services) or a similar patch management solution. Configure systems to check for updates automatically and schedule reboots during maintenance windows. - Use Case: Prevents exploitation of OS vulnerabilities such as privilege escalation or remote code execution.

Application Patching

- Implementation: Monitor Apache's update release notes for security patches addressing vulnerabilities. Schedule updates for off-peak hours to avoid downtime while maintaining security compliance. - Use Case: Prevents exploitation of web application vulnerabilities, such as those leading to unauthorized access or data breaches.

Firmware Updates

- Implementation: Regularly check the vendor’s website for firmware updates addressing vulnerabilities. Plan for update deployment during scheduled maintenance to minimize business disruption. - Use Case: Protects against vulnerabilities that adversaries could exploit to gain access to network devices or inject malicious traffic.

Emergency Patch Deployment

- Implementation: Use the emergency patch deployment feature of the organization's patch management tool to apply updates to all affected Exchange servers within 24 hours. - Use Case: Reduces the risk of exploitation by rapidly addressing critical vulnerabilities.

Centralized Patch Management

- Implementation: Implement a centralized patch management system, such as SCCM or ManageEngine, to automate and track patch deployment across all environments. Generate regular compliance reports to ensure all systems are updated. - Use Case: Streamlines patching processes and ensures no critical systems are missed.

*Tools for Implementation*

Patch Management Tools:

- WSUS: Manage and deploy Microsoft updates across the organization. - ManageEngine Patch Manager Plus: Automate patch deployment for OS and third-party apps. - Ansible: Automate updates across multiple platforms, including Linux and Windows.

Vulnerability Scanning Tools:

- OpenVAS: Open-source vulnerability scanning to identify missing patches.

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
20.0
Object version
1.4
Created
Modified
Raw hash
ea07279060611199...
Imported snapshots across ATT&CK releases(3)
ReleaseBundle importedObject versionModifiedStatusRaw hash
20.01.4Current bundleea0727906061…
19.21.4Older bundleea0727906061…
19.11.4Older bundlea9cae8695590…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Backdooring an AWS account

    Daniel Grzelak. (2016, July 9). Backdooring an AWS account. Retrieved May 27, 2022.

    Open source URL
  2. [2]
    Varonis Power Automate Data Exfiltration

    Eric Saraga. (2022, February 2). Using Power Automate for Covert Data Exfiltration in Microsoft 365. Retrieved May 27, 2022.

    Open source URL
  3. [3]
    Microsoft DART Case Report 001

    Berk Veral. (2020, March 9). Real-life cybercrime stories from DART, the Microsoft Detection and Response Team. Retrieved May 27, 2022.

    Open source URL
  4. [4]
    FireEye WMI 2015

    Ballenthin, W., et al. (2015). Windows Management Instrumentation (WMI) Offense, Defense, and Forensics. Retrieved March 30, 2016.

    Open source URL
  5. [5]
    Malware Persistence on OS X

    Patrick Wardle. (2015). Malware Persistence on OS X Yosemite. Retrieved July 10, 2017.

    Open source URL
  6. [6]
    amnesia malware

    Claud Xiao, Cong Zheng, Yanhui Jia. (2017, April 6). New IoT/Linux Malware Targets DVRs, Forms Botnet. Retrieved February 19, 2018.

    Open source URL
  7. [7]
    mitre-attackT1546
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use