{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1546","id":"T1546","name":"Event Triggered Execution","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1546","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"58a91727a8769cda9f6415e2e809a825117fbdbf400249e130ede56f1f38a52e","description":"Adversaries may establish persistence and/or elevate privileges using system mechanisms that trigger execution based on specific events. Various operating systems have means to monitor and subscribe to events such as logons or other user activity such as running specific applications/binaries. Cloud environments may also support various functions and services that monitor and can be invoked in response to specific cloud events.(Citation: Backdooring an AWS account)(Citation: Varonis Power Automate Data Exfiltration)(Citation: Microsoft DART Case Report 001)\n\nAdversaries may abuse these mechanisms as a means of maintaining persistent access to a victim via repeatedly executing malicious code. After gaining access to a victim system, adversaries may create/modify event triggers to point to malicious content that will be executed whenever the event trigger is invoked.(Citation: FireEye WMI 2015)(Citation: Malware Persistence on OS X)(Citation: amnesia malware)\n\nSince the execution can be proxied by an account with higher permissions, such as SYSTEM or service accounts, an adversary may be able to abuse these triggered execution mechanisms to escalate their privileges. ","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1546","external_id":"T1546"},{"source_name":"FireEye WMI 2015","description":"Ballenthin, W., et al. (2015). Windows Management Instrumentation (WMI) Offense, Defense, and Forensics. Retrieved March 30, 2016.","url":"https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/wp-windows-management-instrumentation.pdf"},{"source_name":"Microsoft DART Case Report 001","description":"Berk Veral. (2020, March 9). Real-life cybercrime stories from DART, the Microsoft Detection and Response Team. Retrieved May 27, 2022.","url":"https://www.microsoft.com/security/blog/2020/03/09/real-life-cybercrime-stories-dart-microsoft-detection-and-response-team"},{"source_name":"amnesia malware","description":"Claud Xiao, Cong Zheng, Yanhui Jia. (2017, April 6). New IoT/Linux Malware Targets DVRs, Forms Botnet. Retrieved February 19, 2018.","url":"https://researchcenter.paloaltonetworks.com/2017/04/unit42-new-iotlinux-malware-targets-dvrs-forms-botnet/"},{"source_name":"Backdooring an AWS account","description":"Daniel Grzelak. (2016, July 9). Backdooring an AWS account. Retrieved May 27, 2022.","url":"https://medium.com/daniel-grzelak/backdooring-an-aws-account-da007d36f8f9"},{"source_name":"Varonis Power Automate Data Exfiltration","description":"Eric Saraga. (2022, February 2). Using Power Automate for Covert Data Exfiltration in Microsoft 365. Retrieved May 27, 2022.","url":"https://www.varonis.com/blog/power-automate-data-exfiltration"},{"source_name":"Malware Persistence on OS X","description":"Patrick Wardle. (2015). Malware Persistence on OS X Yosemite. Retrieved July 10, 2017.","url":"https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf"}],"platforms":["Linux","macOS","Windows","SaaS","IaaS","Office Suite"],"environments":["cloud","cloud-hosted-endpoint","onprem","saas"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[{"key":"enterprise/T1546.001","id":"T1546.001","name":"Change Default File Association","page":"techniques/enterprise/T1546.001/"},{"key":"enterprise/T1546.002","id":"T1546.002","name":"Screensaver","page":"techniques/enterprise/T1546.002/"},{"key":"enterprise/T1546.003","id":"T1546.003","name":"Windows Management Instrumentation Event Subscription","page":"techniques/enterprise/T1546.003/"},{"key":"enterprise/T1546.004","id":"T1546.004","name":"Unix Shell Configuration Modification","page":"techniques/enterprise/T1546.004/"},{"key":"enterprise/T1546.005","id":"T1546.005","name":"Trap","page":"techniques/enterprise/T1546.005/"},{"key":"enterprise/T1546.006","id":"T1546.006","name":"LC_LOAD_DYLIB Addition","page":"techniques/enterprise/T1546.006/"},{"key":"enterprise/T1546.007","id":"T1546.007","name":"Netsh Helper DLL","page":"techniques/enterprise/T1546.007/"},{"key":"enterprise/T1546.008","id":"T1546.008","name":"Accessibility Features","page":"techniques/enterprise/T1546.008/"},{"key":"enterprise/T1546.009","id":"T1546.009","name":"AppCert DLLs","page":"techniques/enterprise/T1546.009/"},{"key":"enterprise/T1546.010","id":"T1546.010","name":"AppInit DLLs","page":"techniques/enterprise/T1546.010/"},{"key":"enterprise/T1546.011","id":"T1546.011","name":"Application Shimming","page":"techniques/enterprise/T1546.011/"},{"key":"enterprise/T1546.012","id":"T1546.012","name":"Image File Execution Options Injection","page":"techniques/enterprise/T1546.012/"},{"key":"enterprise/T1546.013","id":"T1546.013","name":"PowerShell Profile","page":"techniques/enterprise/T1546.013/"},{"key":"enterprise/T1546.014","id":"T1546.014","name":"Emond","page":"techniques/enterprise/T1546.014/"},{"key":"enterprise/T1546.015","id":"T1546.015","name":"Component Object Model Hijacking","page":"techniques/enterprise/T1546.015/"},{"key":"enterprise/T1546.016","id":"T1546.016","name":"Installer Packages","page":"techniques/enterprise/T1546.016/"},{"key":"enterprise/T1546.017","id":"T1546.017","name":"Udev Rules","page":"techniques/enterprise/T1546.017/"},{"key":"enterprise/T1546.018","id":"T1546.018","name":"Python Startup Hooks","page":"techniques/enterprise/T1546.018/"}],"telemetry":[{"id":"DC0069","name":"Cloud Service Modification","page":"telemetry/DC0069/","kind":"attack_component","category":"Cloud control plane","description":"Changes to a managed cloud service configuration.","collection_focus":"Collect the service-specific update API and resulting configuration state; record account/project, actor and changed settings.","providers":[{"name":"AWS CloudTrail","scope":"Management-plane API activity; supported resource/data events require separate selectors.","source_id":"cloudtrail"},{"name":"Azure Monitor Activity Log","scope":"Azure resource control-plane operations; resource data-plane logs are separate.","source_id":"azure"},{"name":"Google Cloud Audit Logs","scope":"Admin Activity and other categories; configure Data Access where required.","source_id":"gcp"}],"configuration":["In the isolated account/project/subscription, route administrative audit logs to a protected destination with retention and access controls.","Select the relevant service, regions and read/write operations. Confirm whether the API below is a management or data event in the provider documentation.","Preserve actor/session, resource, request ID, service, operation, region and error details. Check delivery latency and avoid logging credentials or sensitive request bodies."],"configuration_example":null,"required_fields":["service","resource_id","attribute","before","after"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0069","collector":"illustrative-lab-collector","observation":{"service":"lab-audit-service","resource_id":"lab-service-1","attribute":"retention_days","before":7,"after":30}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"AWS, Azure and Google expose different APIs and event schemas. An accepted API request does not prove the final resource state; join asynchronous outcomes and inventory.","sources":[{"id":"cloudtrail","title":"AWS CloudTrail event categories","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-events.html"},{"id":"ec2","title":"AWS EC2 API logging with CloudTrail","url":"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/monitor-with-cloudtrail.html"},{"id":"azure","title":"Azure Monitor Activity Log","url":"https://learn.microsoft.com/en-us/azure/azure-monitor/fundamentals/activity-log"},{"id":"gcp","title":"Google Cloud Audit Logs","url":"https://docs.cloud.google.com/logging/docs/audit"}],"association":"attack_component","anomaly_design":"Per account, role, region and API: rare actions, new role-resource relationships, enumeration bursts and configuration changes. Separate deployment automation and organization-level administrative activity."},{"id":"DC0064","name":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component","category":"Script and command execution","description":"Execution of a command and its interpreter or parent context.","collection_focus":"Collect process command lines and relevant shell/interpreter audit; shell history alone is neither complete nor tamper-resistant.","providers":[{"name":"PowerShell Script Block Logging","scope":"Script content via event 4104 when configured; channel depends on PowerShell edition.","source_id":"powershell"},{"name":"Sysmon process events","scope":"Interpreter launch and parent context, not full script content.","source_id":"sysmon"},{"name":"Linux Audit","scope":"execve-family execution context; shell built-ins need additional instrumentation.","source_id":"linux"}],"configuration":["Enable Script Block Logging through the policy/configuration for the installed edition. Forward Microsoft-Windows-PowerShell/Operational for Windows PowerShell, or PowerShellCore/Operational for PowerShell 7.","Retain script-block ID and fragment ordering alongside process creation. Protect access to collected script text; secrets may be included.","On Linux, use narrowly scoped Audit execution rules for the lab account and supported architectures, and retain joined SYSCALL/EXECVE/PATH records."],"configuration_example":null,"required_fields":["interpreter","command_line","actor_uid","session_id"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Script content and process command lines are different signals. Logging may be partial, fragmented, filtered or disabled; never assume a command line reveals everything executed.","sources":[{"id":"powershell","title":"Microsoft PowerShell logging on Windows","url":"https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows?view=powershell-7.5"},{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Per host role and principal: rare interpreters, command argument patterns and parent-child sequences. Normalize scripts carefully; obfuscation, administrative automation and missing command lines change visibility."},{"id":"DC0059","name":"File Metadata","page":"telemetry/DC0059/","kind":"attack_component","category":"Host state and inventory","description":"File attributes such as path, size, timestamps, ownership and cryptographic hash.","collection_focus":"Collect scoped file inventory/FIM metadata with hash algorithm and observation time; preserve original timestamps separately from collector time.","providers":[{"name":"osquery","scope":"Scheduled host-state queries; supported tables and privileges vary by OS. Select a table that actually exposes the required object.","source_id":"osquery"},{"name":"Linux Audit plus inventory snapshots","scope":"Events explain changes; snapshots describe state at collection time.","source_id":"linux"}],"configuration":["Define the inventory query, allowed host set, interval and least-privileged reader. Store a stable asset ID, observation time and collector version.","Keep successive snapshots and calculate additions, removals and changed attributes. Pair state changes with audit events when available.","Export collector health and missed-poll counts so a missing snapshot is not misclassified as a missing asset."],"configuration_example":null,"required_fields":["path","size_bytes","sha256","owner_uid"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0059","collector":"illustrative-lab-collector","observation":{"path":"/opt/lab/demo.txt","size_bytes":64,"sha256":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","owner_uid":1000}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.","sources":[{"id":"osquery","title":"osquery scheduled configuration","url":"https://github.com/osquery/osquery/blob/master/docs/wiki/deployment/configuration.md"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Compare authorized state snapshots: first-seen drivers/services/modules, unexpected configuration drift and integrity changes. Record collection cadence; absence in a sample is not evidence of deletion."},{"id":"DC0061","name":"File Modification","page":"telemetry/DC0061/","kind":"attack_component","category":"Endpoint activity","description":"Changes to file data or attributes.","collection_focus":"Use file-integrity monitoring or scoped OS file-write auditing for general changes. Sysmon 2 records creation-time changes; it is not a general file-write event.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["path","attribute","before","after"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0061","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","attribute":"content_hash","before":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","after":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0085","name":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component","category":"Network and protocol telemetry","description":"Packet or decoded application-protocol content visible at a network sensor.","collection_focus":"Scope approved packet capture/protocol content collection to the lab flow; retain capture provenance and truncation indicators.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["flow_id","protocol","method","path","payload_excerpt"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0001","name":"Scheduled Job Creation","page":"telemetry/DC0001/","kind":"attack_component","category":"Windows and directory audit","description":"Creation of a scheduled execution object, including its trigger, principal and executable action.","collection_focus":"Enable Audit Other Object Access Events for Windows task creation (4698); retain task XML. For cron/systemd timers, collect scheduler definitions and change events separately.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["task_name","action","principal","schedule","program"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0001","collector":"illustrative-lab-collector","observation":{"task_name":"LabDailyCheck","action":"create","principal":"lab-user","schedule":"daily","program":"lab-check.exe"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."},{"id":"DC0029","name":"Script Execution","page":"telemetry/DC0029/","kind":"attack_component","category":"Script and command execution","description":"Script content or script execution observations from an interpreter-aware sensor.","collection_focus":"Collect PowerShell 4104 with script-block ID and fragment sequence; instrument other engines separately rather than assigning them the same event ID.","providers":[{"name":"PowerShell Script Block Logging","scope":"Script content via event 4104 when configured; channel depends on PowerShell edition.","source_id":"powershell"},{"name":"Sysmon process events","scope":"Interpreter launch and parent context, not full script content.","source_id":"sysmon"},{"name":"Linux Audit","scope":"execve-family execution context; shell built-ins need additional instrumentation.","source_id":"linux"}],"configuration":["Enable Script Block Logging through the policy/configuration for the installed edition. Forward Microsoft-Windows-PowerShell/Operational for Windows PowerShell, or PowerShellCore/Operational for PowerShell 7.","Retain script-block ID and fragment ordering alongside process creation. Protect access to collected script text; secrets may be included.","On Linux, use narrowly scoped Audit execution rules for the lab account and supported architectures, and retain joined SYSCALL/EXECVE/PATH records."],"configuration_example":{"label":"Read recent Windows PowerShell script-block events","language":"powershell","source_id":"powershell","content":"Get-WinEvent -FilterHashtable @{\n  LogName = 'Microsoft-Windows-PowerShell/Operational'\n  Id = 4104\n} -MaxEvents 5","note":"Read-only check after Script Block Logging is configured. For PowerShell 7 use its registered PowerShellCore/Operational channel. Missing events are not proof of no execution; check policy, channel and permissions."},"required_fields":["engine","script_block_id","fragment","fragments_total","script_text"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0029","collector":"illustrative-lab-collector","observation":{"engine":"PowerShell","script_block_id":"lab-script-1","fragment":1,"fragments_total":1,"script_text":"Write-Output \"LAB_TELEMETRY_CHECK\""}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Script content and process command lines are different signals. Logging may be partial, fragmented, filtered or disabled; never assume a command line reveals everything executed.","sources":[{"id":"powershell","title":"Microsoft PowerShell logging on Windows","url":"https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows?view=powershell-7.5"},{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Per host role and principal: rare interpreters, command argument patterns and parent-child sequences. Normalize scripts carefully; obfuscation, administrative automation and missing command lines change visibility."},{"id":"DC0008","name":"WMI Creation","page":"telemetry/DC0008/","kind":"attack_component","category":"Endpoint activity","description":"Creation of WMI objects relevant to event subscriptions or other instrumented WMI activity.","collection_focus":"For permanent subscriptions, collect Sysmon WmiEvent 19–21 and retain filter, consumer and binding information; this is not comprehensive auditing of every WMI operation.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","Keep this Windows-specific source separate from other operating systems; there is no direct cross-platform event-ID equivalence."],"configuration_example":null,"required_fields":["object_kind","namespace","object_name","action"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0008","collector":"illustrative-lab-collector","observation":{"object_kind":"event_filter","namespace":"root/subscription","object_name":"LabFilter","action":"create"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0063","name":"Windows Registry Key Modification","page":"telemetry/DC0063/","kind":"attack_component","category":"Endpoint activity","description":"Registry value changes or registry object renames.","collection_focus":"Use RegistryEvent 13 for value-set and 14 for rename; compare against intended policy and keep original type/value where available.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","Keep this Windows-specific source separate from other operating systems; there is no direct cross-platform event-ID equivalence."],"configuration_example":null,"required_fields":["registry_path","event_type","value_type","value"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0063","collector":"illustrative-lab-collector","observation":{"registry_path":"HKCU\\Software\\Lab\\Mode","event_type":"SetValue","value_type":"DWORD","value":1}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."}],"detection":{"key":"enterprise/T1546","id":"T1546","name":"Event Triggered Execution","domain":"enterprise","platforms":["Linux","macOS","Windows","SaaS","IaaS","Office Suite"],"environments":["cloud","cloud-hosted-endpoint","onprem","saas"],"source_url":"https://attack.mitre.org/techniques/T1546","technique_page":"techniques/enterprise/T1546/","page":"detections/enterprise/T1546/","status":"rule_source_available","counts":{"sigma":7,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":6,"live_validated":0},"sigma_rules":[{"id":"8c31f563-f9a7-450c-bfa8-35f8f32f1f61","title":"New Outlook Macro Created","status":"test","level":"medium","logsource":{"category":"file_event","product":"windows"},"data_path":"data/detection-rules/8c31f563-f9a7-450c-bfa8-35f8f32f1f61.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_office_outlook_macro_creation.yml","author":"@ScoubiMtl","kind":"sigma"},{"id":"117d3d3a-755c-4a61-b23e-9171146d094c","title":"Suspicious Outlook Macro Created","status":"test","level":"high","logsource":{"category":"file_event","product":"windows"},"data_path":"data/detection-rules/117d3d3a-755c-4a61-b23e-9171146d094c.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_office_outlook_susp_macro_creation.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"0c3fac91-5627-46e8-a6a8-a0d7b9b8ae1b","title":"Suspicious Get-Variable.exe Creation","status":"test","level":"high","logsource":{"product":"windows","category":"file_event"},"data_path":"data/detection-rules/0c3fac91-5627-46e8-a6a8-a0d7b9b8ae1b.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_susp_get_variable.yml","author":"frack113","kind":"sigma"},{"id":"0ba863e6-def5-4e50-9cea-4dd8c7dc46a4","title":"Control Panel Items","status":"test","level":"high","logsource":{"product":"windows","category":"process_creation"},"data_path":"data/detection-rules/0ba863e6-def5-4e50-9cea-4dd8c7dc46a4.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_control_panel_item.yml","author":"Kyaw Min Thein, Furkan Caliskan (@caliskanfurkan_)","kind":"sigma"},{"id":"07743f65-7ec9-404a-a519-913db7118a8d","title":"COM Hijack via Sdclt","status":"test","level":"high","logsource":{"category":"registry_set","product":"windows"},"data_path":"data/detection-rules/07743f65-7ec9-404a-a519-913db7118a8d.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_comhijack_sdclt.yml","author":"Omkar Gudhate","kind":"sigma"},{"id":"396ae3eb-4174-4b9b-880e-dc0364d78a19","title":"Potential Persistence Via Outlook LoadMacroProviderOnBoot Setting","status":"test","level":"high","logsource":{"category":"registry_set","product":"windows"},"data_path":"data/detection-rules/396ae3eb-4174-4b9b-880e-dc0364d78a19.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_office_outlook_enable_load_macro_provider_on_boot.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"e3b50fa5-3c3f-444e-937b-0a99d33731cd","title":"Outlook Macro Execution Without Warning Setting Enabled","status":"test","level":"high","logsource":{"category":"registry_set","product":"windows"},"data_path":"data/detection-rules/e3b50fa5-3c3f-444e-937b-0a99d33731cd.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_office_outlook_enable_macro_execution.yml","author":"@ScoubiMtl","kind":"sigma"}],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0010","name":"Behavioral Detection of Event Triggered Execution Across Platforms","url":"https://attack.mitre.org/detectionstrategies/DET0010","stix_id":"x-mitre-detection-strategy--c5e3823f-5ee0-43db-b6fa-b63d6587b24c","relationship_id":"relationship--e6a8c456-3c2e-44a6-8614-b5c3e7cb4d98","description":"","analytics":[{"id":"AN0024","name":"Analytic 0024","guidance":"Correlates unexpected modifications to WMI event filters, scheduled task triggers, or registry autorun keys with subsequent execution of non-standard binaries by SYSTEM-level processes.","url":"https://attack.mitre.org/detectionstrategies/DET0010#AN0024","platforms":["Windows"],"tuning":[{"field":"UserContext","description":"Filters triggering on SYSTEM or LOCAL SERVICE vs. user-initiated triggers"},{"field":"TimeWindow","description":"Correlates trigger definition and execution timing (e.g., within 5 minutes)"},{"field":"PathAnomalyThreshold","description":"Process or binary path deviation scoring for execution anomalies"}],"log_sources":[{"component_id":"DC0001","component":"Scheduled Job Creation","name":"WinEventLog:Security","channel":"EventCode=4698","platforms":["Windows"],"analytic_id":"AN0024","source_url":"https://attack.mitre.org/detectionstrategies/DET0010#AN0024","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0001/"},{"component_id":"DC0008","component":"WMI Creation","name":"WinEventLog:WMI","channel":"Creation or modification of __EventFilter, __FilterToConsumerBinding, or CommandLineEventConsumer","platforms":["Windows"],"analytic_id":"AN0024","source_url":"https://attack.mitre.org/detectionstrategies/DET0010#AN0024","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0008/"},{"component_id":"DC0063","component":"Windows Registry Key Modification","name":"WinEventLog:Security","channel":"EventCode=4657","platforms":["Windows"],"analytic_id":"AN0024","source_url":"https://attack.mitre.org/detectionstrategies/DET0010#AN0024","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0063/"},{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Sysmon","channel":"EventCode=1","platforms":["Windows"],"analytic_id":"AN0024","source_url":"https://attack.mitre.org/detectionstrategies/DET0010#AN0024","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"}]},{"id":"AN0025","name":"Analytic 0025","guidance":"Detects inotify or auditd configuration changes that monitor system files coupled with execution of script interpreters or binaries by cron or systemd timers.","url":"https://attack.mitre.org/detectionstrategies/DET0010#AN0025","platforms":["Linux"],"tuning":[{"field":"ExecutablePathRegex","description":"Regex defining suspicious binary/script paths triggered by cron/systemd"},{"field":"WatchTargetPaths","description":"Paths monitored by auditd/inotify for suspicious event registration"}],"log_sources":[{"component_id":"DC0059","component":"File Metadata","name":"auditd:SYSCALL","channel":"Inotify watch creation or auditctl changes on /etc/cron* or /lib/systemd/system/","platforms":["Linux"],"analytic_id":"AN0025","source_url":"https://attack.mitre.org/detectionstrategies/DET0010#AN0025","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0059/"},{"component_id":"DC0001","component":"Scheduled Job Creation","name":"linux:syslog","channel":"Execution of non-standard script or binary by cron","platforms":["Linux"],"analytic_id":"AN0025","source_url":"https://attack.mitre.org/detectionstrategies/DET0010#AN0025","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0001/"},{"component_id":"DC0064","component":"Command Execution","name":"auditd:SYSCALL","channel":"Execution of script interpreters by systemd timer (ExecStart)","platforms":["Linux"],"analytic_id":"AN0025","source_url":"https://attack.mitre.org/detectionstrategies/DET0010#AN0025","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"}]},{"id":"AN0026","name":"Analytic 0026","guidance":"Correlates launchd plist modifications with subsequent unauthorized script execution or anomalous parent-child process trees involving user agents.","url":"https://attack.mitre.org/detectionstrategies/DET0010#AN0026","platforms":["macOS"],"tuning":[{"field":"PlistNamePattern","description":"Regex pattern matching known rogue or unrecognized launchd plist names"},{"field":"ParentProcessBaseline","description":"Expected parent-child relationships during plist-triggered execution"}],"log_sources":[{"component_id":"DC0061","component":"File Modification","name":"macos:unifiedlog","channel":"Modification of ~/Library/LaunchAgents or /Library/LaunchDaemons plist","platforms":["macOS"],"analytic_id":"AN0026","source_url":"https://attack.mitre.org/detectionstrategies/DET0010#AN0026","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0061/"},{"component_id":"DC0032","component":"Process Creation","name":"macos:unifiedlog","channel":"Execution of launchctl with suspicious arguments","platforms":["macOS"],"analytic_id":"AN0026","source_url":"https://attack.mitre.org/detectionstrategies/DET0010#AN0026","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"}]},{"id":"AN0027","name":"Analytic 0027","guidance":"Monitors cloud function creation triggered by specific audit log events (e.g., IAM changes, object creation), followed by anomalous behavior from new service accounts.","url":"https://attack.mitre.org/detectionstrategies/DET0010#AN0027","platforms":["IaaS"],"tuning":[{"field":"TriggerEventType","description":"Specific cloud event (e.g., PutObject, CreateRole) that causes function invocation"},{"field":"ServiceAccountRole","description":"Expected permissions for roles used in function execution"}],"log_sources":[{"component_id":"DC0069","component":"Cloud Service Modification","name":"AWS:CloudTrail","channel":"CreateFunction","platforms":["IaaS"],"analytic_id":"AN0027","source_url":"https://attack.mitre.org/detectionstrategies/DET0010#AN0027","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0069/"},{"component_id":"DC0064","component":"Command Execution","name":"AWS:CloudTrail","channel":"InvokeFunction","platforms":["IaaS"],"analytic_id":"AN0027","source_url":"https://attack.mitre.org/detectionstrategies/DET0010#AN0027","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"}]},{"id":"AN0028","name":"Analytic 0028","guidance":"Correlates Power Automate or similar logic app workflows triggered by SaaS file uploads or email rules with data forwarding or anomalous access patterns.","url":"https://attack.mitre.org/detectionstrategies/DET0010#AN0028","platforms":["SaaS"],"tuning":[{"field":"TriggerCondition","description":"Event types that initiate SaaS automation (e.g., file add, new email)"},{"field":"AppIdentityScope","description":"Scopes/permissions granted to automation app accounts"}],"log_sources":[{"component_id":"DC0069","component":"Cloud Service Modification","name":"m365:unified","channel":"Creation of Power Automate flow triggered by OneDrive or Exchange event","platforms":["SaaS"],"analytic_id":"AN0028","source_url":"https://attack.mitre.org/detectionstrategies/DET0010#AN0028","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0069/"},{"component_id":"DC0064","component":"Command Execution","name":"m365:unified","channel":"Automated forwarding or file sync initiated by a logic app","platforms":["SaaS"],"analytic_id":"AN0028","source_url":"https://attack.mitre.org/detectionstrategies/DET0010#AN0028","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"}]},{"id":"AN0029","name":"Analytic 0029","guidance":"Detects macros or VBA triggers set to execute on document open or close events, often correlating with embedded payloads or C2 traffic shortly after execution.","url":"https://attack.mitre.org/detectionstrategies/DET0010#AN0029","platforms":["Office Suite"],"tuning":[{"field":"MacroFunctionNames","description":"Names of event-bound functions like Auto_Open that initiate execution"},{"field":"TimeDeltaMacroToC2","description":"Time threshold to correlate macro execution with outbound connections"}],"log_sources":[{"component_id":"DC0029","component":"Script Execution","name":"m365:office","channel":"VBA auto_open, auto_close, or document_open events","platforms":["Office Suite"],"analytic_id":"AN0029","source_url":"https://attack.mitre.org/detectionstrategies/DET0010#AN0029","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0029/"},{"component_id":"DC0085","component":"Network Traffic Content","name":"m365:office","channel":"External HTTP/DNS connection from Office binary shortly after macro trigger","platforms":["Office Suite"],"analytic_id":"AN0029","source_url":"https://attack.mitre.org/detectionstrategies/DET0010#AN0029","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0085/"}]}]}],"telemetry_references":[{"id":"DC0069","name":"Cloud Service Modification","tag":"Cloud Service Modification","page":"telemetry/DC0069/","kind":"attack_component"},{"id":"DC0064","name":"Command Execution","tag":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component"},{"id":"DC0059","name":"File Metadata","tag":"File Metadata","page":"telemetry/DC0059/","kind":"attack_component"},{"id":"DC0061","name":"File Modification","tag":"File Modification","page":"telemetry/DC0061/","kind":"attack_component"},{"id":"DC0085","name":"Network Traffic Content","tag":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"},{"id":"DC0001","name":"Scheduled Job Creation","tag":"Scheduled Job Creation","page":"telemetry/DC0001/","kind":"attack_component"},{"id":"DC0029","name":"Script Execution","tag":"Script Execution","page":"telemetry/DC0029/","kind":"attack_component"},{"id":"DC0008","name":"WMI Creation","tag":"WMI Creation","page":"telemetry/DC0008/","kind":"attack_component"},{"id":"DC0063","name":"Windows Registry Key Modification","tag":"Windows Registry Key Modification","page":"telemetry/DC0063/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[{"id":"S1091","name":"Pacu","page":"tools/S1091/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[{"id":"S1091","name":"Pacu","page":"tools/S1091/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"software":[{"id":"S0658","name":"XCSSET","url":"https://attack.mitre.org/software/S0658","kind":"malware","description":"[XCSSET](https://attack.mitre.org/software/S0658)'s `dfhsebxzod` module searches for `.xcodeproj` directories within the user’s home folder and subdirectories. For each match, it locates the corresponding `project.pbxproj` file and embeds an encoded payload into a build rule, target configuration, or project setting. The payload is later executed during the build process.(Citation: Microsoft March 2025 XCSSET)(Citation: April 2021 TrendMicro XCSSET)","relationship_id":"relationship--e939c173-65a4-453e-b45e-d3cbef9b10dd","references":[{"source_name":"Microsoft March 2025 XCSSET","description":"Microsoft Threat Intelligence. (2025, March 11). New XCSSET malware adds new obfuscation, persistence techniques to infect Xcode projects. Retrieved April 2, 2025.","url":"https://www.microsoft.com/en-us/security/blog/2025/03/11/new-xcsset-malware-adds-new-obfuscation-persistence-techniques-to-infect-xcode-projects/"},{"source_name":"April 2021 TrendMicro XCSSET","description":"Steven Du, Dechao Zhao, Luis Magisa, Ariel Neimond Lazaro. (2021, April 16). XCSSET Quickly Adapts to macOS 11 and M1-based Macs. Retrieved February 18, 2025.","url":"https://www.trendmicro.com/en_us/research/21/d/xcsset-quickly-adapts-to-macos-11-and-m1-based-macs.html"}]},{"id":"S1091","name":"Pacu","url":"https://attack.mitre.org/software/S1091","kind":"tool","description":"[Pacu](https://attack.mitre.org/software/S1091) can set up S3 bucket notifications to trigger a malicious Lambda function when a CloudFormation template is uploaded to the bucket. It can also create Lambda functions that trigger upon the creation of users, roles, and groups.(Citation: GitHub Pacu)","relationship_id":"relationship--804f7690-6bf2-41dc-a6d2-59c3d4394ce5","references":[{"source_name":"GitHub Pacu","description":"Rhino Security Labs. (2019, August 22). Pacu. Retrieved October 17, 2019.","url":"https://github.com/RhinoSecurityLabs/pacu"}]},{"id":"S1164","name":"UPSTYLE","url":"https://attack.mitre.org/software/S1164","kind":"malware","description":"[UPSTYLE](https://attack.mitre.org/software/S1164) creates a `.pth` file beginning with the text `import` so that any time another process or script attempts to reference the modified item the malicious code will also run.(Citation: Volexity UPSTYLE 2024)","relationship_id":"relationship--d61fe745-b222-48de-aa48-1b948780b9dd","references":[{"source_name":"Volexity UPSTYLE 2024","description":"Volexity Threat Research. (2024, April 12). Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400). Retrieved November 20, 2024.","url":"https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/"}]},{"id":"S9043","name":"Mini Shai-Hulud","url":"https://attack.mitre.org/software/S9043","kind":"malware","description":"[Mini Shai-Hulud](https://attack.mitre.org/software/S9043) has modified settings and configuration files of AI coding agents and other coding applications in order to create event triggered executions through creating hooks and runOn conditions.(Citation: Flashpoint Mini Shai-Hulud MAY 2026)","relationship_id":"relationship--efc15678-c8f8-4225-98bb-f9d070e163fe","references":[{"source_name":"Flashpoint Mini Shai-Hulud MAY 2026","description":"Flashpoint. (2026, May 28). The Mini Shai-Hulud Worm and the New Era of CI/CD Exploitation. Retrieved July 16, 2026.","url":"https://flashpoint.io/blog/mini-shai-hulud-worm-new-era-ci-cd-exploitation/"}]}],"actors":[],"mitigations":[{"id":"M1026","name":"Privileged Account Management","url":"https://attack.mitre.org/mitigations/M1026","kind":"course-of-action","description":"Manage the creation, modification, use, and permissions associated to privileged accounts, including SYSTEM and root.","relationship_id":"relationship--a3985a50-df7f-489f-a033-1a6b6e41382e","references":[]},{"id":"M1051","name":"Update Software","url":"https://attack.mitre.org/mitigations/M1051","kind":"course-of-action","description":"Perform regular software updates to mitigate exploitation risk.","relationship_id":"relationship--fc2f3e79-2740-4113-9875-4193b532d73e","references":[]}],"candidates":[{"id":"17d1a3cc-3373-495a-857a-e5dd005fb302","name":"Adding custom debugger for Windows Error Reporting","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546/T1546.yaml","description":"When applications hang, the Windows Error Reporting framework allows us to attach a debugger, if it is set up in the Registry.\nAdding executable of choice will let the executable to auto-execute when during any application crash due to functioning of WER framework\n","inputs":{},"dependencies":[],"source_definition_sha256":"226056736e719389b0e1fd72768c79b0dfe5f4dc0c7dd317f570e780e80012ff"},{"id":"2db7852e-5a32-4ec7-937f-f4e027881700","name":"Load custom DLL on mstsc execution","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546/T1546.yaml","description":"Adding ClxDllPath under Terminal Server Client subkey of HKLM hive with a path to custom DLL allows for DLL loading during execution of mstsc.exe\n","inputs":{"dll_inf":{"description":"custom DLL to be executed","type":"Path","default":"C:\\Windows\\System32\\amsi.dll"}},"dependencies":[],"source_definition_sha256":"a1ef965c57c948bab9a14328550a1982f9f6d1e6deae74272631fb96b3c18880"},{"id":"36b8dbf9-59b1-4e9b-a3bb-36e80563ef01","name":"HKCU - Persistence using CommandProcessor AutoRun key (Without Elevation)","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546/T1546.yaml","description":"An adversary may abuse the CommandProcessor AutoRun registry key to persist. Every time cmd.exe is executed, the command defined in the AutoRun key also gets executed.\n[reference](https://devblogs.microsoft.com/oldnewthing/20071121-00/?p=24433)","inputs":{"command":{"description":"Command to Execute","type":"string","default":"notepad.exe"}},"dependencies":[],"source_definition_sha256":"cd27aa3ef3d031091b28cc1522291a0c970da2ff718a12b985e1a783e905b54b"},{"id":"547a4736-dd1c-4b48-b4fe-e916190bb2e7","name":"Persistence via ErrorHandler.cmd script execution","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546/T1546.yaml","description":"Create persistence by triggering script within ErrorHandler.cmd upon the execution of specific binaries within the oobe directory.\nUpon test execution, Setup.exe will be executed to further execute script within ErrorHandlercmd to launch Notepad.\n","inputs":{},"dependencies":[{"description":"ErrorHandler.cmd script must exist on disk at specified at PathToAtomicsFolder\\T1546\\bin\\ErrorHandler.cmd\n"}],"source_definition_sha256":"d4197dfced6f2e9bdef23313412bc43e94787585078c482d2a193843b859aa11"},{"id":"a574dafe-a903-4cce-9701-14040f4f3532","name":"HKLM - Persistence using CommandProcessor AutoRun key (With Elevation)","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546/T1546.yaml","description":"An adversary may abuse the CommandProcessor AutoRun registry key to persist. Every time cmd.exe is executed, the command defined in the AutoRun key also gets executed.\n[reference](https://devblogs.microsoft.com/oldnewthing/20071121-00/?p=24433)","inputs":{"command":{"description":"Command to Execute","type":"string","default":"notepad.exe"}},"dependencies":[],"source_definition_sha256":"62b79eab4e6fb1fac5de3d1710d2f977bcfd3ec6e8782121828afa6d319227cd"},{"id":"aca9ae16-7425-4b6d-8c30-cad306fdbd5b","name":"Persistence with Custom AutodialDLL","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546/T1546.yaml","description":"The DLL pointed to by the AutodialDLL registry key is loaded every time a process connects to the internet. Attackers can gain persistent code execution by setting this key to a DLL of their choice. \n\nThe sample dll provided, AltWinSock2DLL, will launch the notepad process. Starting and stopping a web browser such as MS Edge or Chrome should result in the dll executing.\n[Blog](https://www.mdsec.co.uk/2022/10/autodialdlling-your-way/)\n","inputs":{},"dependencies":[{"description":"AltWinSock2DLL DLL must exist on disk at specified at PathToAtomicsFolder\\T1546\\bin\\AltWinSock2DLL.dll\n"}],"source_definition_sha256":"1f6ec9dcf2776b1236e8b71814d61547182ee6c8a057ea3fa09a67cb58106e2e"},{"id":"adae83d3-0df6-45e7-b2c3-575f91584577","name":"WMI Invoke-CimMethod Start Process","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546/T1546.yaml","description":"The following Atomic will create a New-CimSession on a remote endpoint and start a process usnig Invoke-CimMethod.\nThis is a novel way to perform lateral movement or to start a remote process.\nThis does require WinRM to be enabled. The account performing the run will also need to be elevated.\nA successful execution will stdout that the process started. On the remote endpoint, wmiprvse.exe will spawn the given process.\n","inputs":{"dest":{"description":"destination computer name","type":"string","default":"localhost"},"password":{"description":"password for account","type":"string","default":"P@ssword1"},"username":{"description":"account to use","type":"string","default":"Administrator"},"process":{"description":"process to spawn","type":"string","default":"calc.exe"}},"dependencies":[],"source_definition_sha256":"a9d9082b1162adb5bf93ea234026a44586442a47542166331426e8d8f598295c"},{"id":"b7fc4c3f-fe6e-479a-ba27-ef91b88536e3","name":"Persistence using automatic execution of custom DLL during RDP session","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546/T1546.yaml","description":"When remote desktop session is accepted, the system queries the key it queries the Registry key:HKLM\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\AddIns\\TestDVCPlugin. \nIf such key exists, the OS will attempt to read the Path value underneath.Once the Path is read, the DLL that it points to will be loaded via LoadLibrary.","inputs":{},"dependencies":[],"source_definition_sha256":"5db836ab544f2ca4993ffb0f58165f4ee6a20513a9a04cf0989a885db9d0b190"},{"id":"f0027655-25ef-47b0-acaf-3d83d106156c","name":"Persistence using STARTUP-PATH in MS-WORD","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546/T1546.yaml","description":"When Word starts, it searches for the registry key HKCU\\Software\\Microsoft\\Office\\<version>\\Word\\Options\\STARTUP-PATH and if it exists,\nit will treat it as a user specific start-up folder and load the contents of the folder with file extensions of .wll,.lnk,.dotm,.dot,.dotx\nThe registry key can be abused to load malware from the mentioned path. Reboot might be required.","inputs":{},"dependencies":[],"source_definition_sha256":"e9a48df36d1ba1f4c8f7d9bdf7bb6e539928eda0f9240d7e235d01367c309b7b"}],"simulation":{"atomic_status":"documented_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1546":"/ttp-simulation/techniques/enterprise/T1546/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1546","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0069","collector":"illustrative-lab-collector","observation":{"service":"lab-audit-service","resource_id":"lab-service-1","attribute":"retention_days","before":7,"after":30}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0059","collector":"illustrative-lab-collector","observation":{"path":"/opt/lab/demo.txt","size_bytes":64,"sha256":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","owner_uid":1000}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0061","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","attribute":"content_hash","before":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","after":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0001","collector":"illustrative-lab-collector","observation":{"task_name":"LabDailyCheck","action":"create","principal":"lab-user","schedule":"daily","program":"lab-check.exe"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0029","collector":"illustrative-lab-collector","observation":{"engine":"PowerShell","script_block_id":"lab-script-1","fragment":1,"fragments_total":1,"script_text":"Write-Output \"LAB_TELEMETRY_CHECK\""}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0008","collector":"illustrative-lab-collector","observation":{"object_kind":"event_filter","namespace":"root/subscription","object_name":"LabFilter","action":"create"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0063","collector":"illustrative-lab-collector","observation":{"registry_path":"HKCU\\Software\\Lab\\Mode","event_type":"SetValue","value_type":"DWORD","value":1}}]}}