tfMITRE ATT&CK sub-technique

Emond T1546.014

sub-technique of T1546 Event Triggered Execution

Tactics: Persistence, Privilege Escalation
Platform: macOS
Version: 1.1
Created: 24 January 2020
Last modified: 24 October 2025
Contributor: Ivan Sinyakov

Adversaries may gain persistence and elevate privileges by executing malicious content triggered by the Event Monitor Daemon (emond). Emond is a Launch Daemon that accepts events from various services, runs them through a simple rules engine, and takes action. The emond binary at /sbin/emond will load any rules from the /etc/emond.d/rules/ directory and take action once an explicitly defined event takes place.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareNone recorded

Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.

Detection rules42nd pct

Detection rules42nd percentile · 58% of ATT&CK techniques have more detection rules written.

Offense vs defense T1546.014

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 1Splunk ESCU (cumulative) · 0

first rule: 2020 Q4

Emond detection strategy DET0555

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for Event Triggered Execution via emond on macOS

Enterprise

1 platform

AN1534 · macOS

Detection focuses on identifying unauthorized file creation or modification within /etc/emond.d/rules/ or /private/var/db/emondClients, which indicate attempts to register a malicious emond rule. Correlate with process execution of /sbin/emond and any launched commands it invokes, especially during boot or login events. Anomalies may include rules created by non-root users or unexpected shell commands executed by emond.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	execution of /sbin/emond with child processes launched
File CreationDC0039	macos:unifiedlog	file create or modify in /etc/emond.d/rules or /private/var/db/emondClients
File ModificationDC0061	macos:unifiedlog	rule definitions written to emond rule plists
Command ExecutionDC0064	macos:unifiedlog	command execution triggered by emond (e.g., shell, curl, python)

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
PathPrefix	Paths such as `/etc/emond.d/rules/` and `/private/var/db/emondClients` may vary slightly or be symlinked in some setups
TimeWindow	The time range for correlating rule file creation to emond execution may be tuned based on system performance and usage
ParentProcessFilter	Defenders may wish to restrict alerts to emond processes not spawned from trusted system update or provisioning tools
CommandPatternList	List of known suspicious commands or binaries used by adversaries (e.g., reverse shells, persistence scripts)

Tests1Executorssh 1Need elevation1 of 1Have prerequisites0Have cleanup1Platformsmacos

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Persistance with Event Monitor - emond

macos

Required

—

Yes

Establish persistence via a rule run by OSX's emond (Event Monitor) daemon at startup, based on https://posts.specterops.io/leveraging-emond-on-macos-for-persistence-a040a2785124

Input arguments

Name	Type	Default	Description
plist	path	PathToAtomicsFolder/T1546.014/src/T1546.014_emond.plist	Path to attacker emond plist file

Attack command

sudo cp "#{plist}" /etc/emond.d/rules/T1546.014_emond.plist
sudo touch /private/var/db/emondClients/T1546.014

Cleanup command

sudo rm /etc/emond.d/rules/T1546.014_emond.plist
sudo rm /private/var/db/emondClients/T1546.014

GUID7da11d09-e90c-41ec-94c0-c131ca5cbb91

Tests from Atomic Red Team (MIT licence) · technique definition

Emond detections T1546.014

1 rule is mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

42nd pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs