| name | T1546_event-triggered-execution |
| description | Adversaries may establish persistence and/or elevate privileges using system mechanisms that trigger execution based on specific events. |
| category | authorization |
| version | 18.1 |
| author | cyberstrike-official |
| tags | ["mitre-attack","enterprise","t1546","privilege-escalation","persistence","linux","macos","windows","saas","iaas","office-suite"] |
| technique_id | T1546 |
| tactic | privilege-escalation |
| all_tactics | ["privilege-escalation","persistence"] |
| platforms | ["Linux","macOS","Windows","SaaS","IaaS","Office Suite"] |
| mitre_url | https://attack.mitre.org/techniques/T1546 |
| tech_stack | ["linux","macos","windows","saas","cloud","office"] |
| cwe_ids | ["CWE-269"] |
| chains_with | ["T1546.001","T1546.002","T1546.003","T1546.004","T1546.005","T1546.006","T1546.007","T1546.008","T1546.009","T1546.010","T1546.011","T1546.012","T1546.013","T1546.014","T1546.015","T1546.016","T1546.017","T1546.018"] |
| prerequisites | [] |
| severity_boost | {"T1546.001":"Chain with T1546.001 for deeper attack path","T1546.002":"Chain with T1546.002 for deeper attack path","T1546.003":"Chain with T1546.003 for deeper attack path"} |
T1546 Event Triggered Execution
High-Level Description
Adversaries may establish persistence and/or elevate privileges using system mechanisms that trigger execution based on specific events. Various operating systems have means to monitor and subscribe to events such as logons or other user activity such as running specific applications/binaries. Cloud environments may also support various functions and services that monitor and can be invoked in response to specific cloud events.
Adversaries may abuse these mechanisms as a means of maintaining persistent access to a victim via repeatedly executing malicious code. After gaining access to a victim system, adversaries may create/modify event triggers to point to malicious content that will be executed whenever the event trigger is invoked.
Since the execution can be proxied by an account with higher permissions, such as SYSTEM or service accounts, an adversary may be able to abuse these triggered execution mechanisms to escalate their privileges.
Kill Chain Phase
- Privilege Escalation (TA0004)
- Persistence (TA0003)
Platforms: Linux, macOS, Windows, SaaS, IaaS, Office Suite
What to Check
How to Test
Atomic Red Team Tests
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
Atomic Test 1: Persistence with Custom AutodialDLL
The DLL pointed to by the AutodialDLL registry key is loaded every time a process connects to the internet. Attackers can gain persistent code execution by setting this key to a DLL of their choice.
The sample dll provided, AltWinSock2DLL, will launch the notepad process. Starting and stopping a web browser such as MS Edge or Chrome should result in the dll executing.
Blog
Supported Platforms: windows
Yes
