Event Triggered Execution
Where this stands
A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.
All three brief analytics restate a more specific technique rather than describing anything unique to the T1546 parent. AN0024 (Windows) is explicitly 'WMI event filters, scheduled task triggers, or registry autorun keys' — WMI event filters are T1546.003's own mechanism, registry autorun keys are T1547.001 (a different technique family), and scheduled task triggers are T1053, also a different family entirely. AN0025 (Linux) keys on cron and systemd-timer execution, which is T1053.003/T1053.006, not a T1546 child at all — the corpus has no T1546 child for cron/systemd. AN0026 (macOS) is launchd plist modification plus launchctl execution, which ATT&CK models under Create or Modify System Process: Launch Daemon (T1543.001), not under Event Triggered Execution. […]
Covered instead by T1546.003, T1547.001, T1053.003, T1053.006, T1543.001.
What the technique is
Adversaries may establish persistence and/or elevate privileges using system mechanisms that trigger execution based on specific events. Various operating systems have means to monitor and subscribe to events such as logons or other user activity such as running specific applications/binaries. Cloud environments may also support various functions and services that monitor and can be invoked in response to specific cloud events. Adversaries may abuse these mechanisms as a means of maintaining persistent access to a victim via repeatedly executing malicious code. After gaining access to a victim system, adversaries may create/modify event triggers to point to malicious content that will be executed whenever the event trigger is invoked. Since the execution can be proxied by an account with higher permissions, such as SYSTEM or service accounts, an adversary may be able to abuse these triggered execution mechanisms to escalate their privileges.
Read it on attack.mitre.orgWhat MITRE says you would watch
- AN0024
Correlates unexpected modifications to WMI event filters, scheduled task triggers, or registry autorun keys with subsequent execution of non-standard binaries by SYSTEM-level processes.
- AN0025
Detects inotify or auditd configuration changes that monitor system files coupled with execution of script interpreters or binaries by cron or systemd timers.
- AN0026
Correlates launchd plist modifications with subsequent unauthorized script execution or anomalous parent-child process trees involving user agents.
Technique names and descriptions © MITRE ATT&CK®, CC BY 4.0. Not endorsed by MITRE.