aol.pm

Event Triggered Execution

Technique · ATTACK:enterprise:T1546

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:enterprise:T1546",
  "title": "Event Triggered Execution",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1546",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--b6301b64-ef57-4cce-bb0b-77026f14a8db",
  "external_id": "T1546",
  "domain": "enterprise",
  "created": "2020-01-22T21:04:23.285Z",
  "modified": "2026-08-04T20:30:56.386Z",
  "version": "1.4",
  "aliases": [

  ],
  "tactics": [
    "privilege-escalation",
    "persistence"
  ],
  "source_references": [
    {
      "source_name": "FireEye WMI 2015",
      "url": "https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/wp-windows-management-instrumentation.pdf"
    },
    {
      "source_name": "Microsoft DART Case Report 001",
      "url": "https://www.microsoft.com/security/blog/2020/03/09/real-life-cybercrime-stories-dart-microsoft-detection-and-response-team"
    },
    {
      "source_name": "amnesia malware",
      "url": "https://researchcenter.paloaltonetworks.com/2017/04/unit42-new-iotlinux-malware-targets-dvrs-forms-botnet/"
    },
    {
      "source_name": "Backdooring an AWS account",
      "url": "https://medium.com/daniel-grzelak/backdooring-an-aws-account-da007d36f8f9"
    },
    {
      "source_name": "Varonis Power Automate Data Exfiltration",
      "url": "https://www.varonis.com/blog/power-automate-data-exfiltration"
    },
    {
      "source_name": "Malware Persistence on OS X",
      "url": "https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf"
    }
  ]
}

Explicit source assertions (25)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:T1546.002 → subtechnique-of → ATTACK:enterprise:T1546

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--15665bbf-2c42-4232-a5c1-b01ffea13041

ATTACK:enterprise:T1546.013 → subtechnique-of → ATTACK:enterprise:T1546

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1628074c-99e3-42b3-bea9-85c7fe6a6bb8

ATTACK:enterprise:T1546.016 → subtechnique-of → ATTACK:enterprise:T1546

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1e950346-c2b5-4b79-a2a0-d0b1ed1a221b

ATTACK:enterprise:T1546.003 → subtechnique-of → ATTACK:enterprise:T1546

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--39084aef-6ba7-4370-832f-b10002b97804

ATTACK:enterprise:T1546.006 → subtechnique-of → ATTACK:enterprise:T1546

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--45ac8255-65b5-4cae-92ce-1e435da5efa1

ATTACK:enterprise:T1546.018 → subtechnique-of → ATTACK:enterprise:T1546

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4cf85862-83bd-4982-aa75-499fa5210c75

ATTACK:enterprise:T1546.011 → subtechnique-of → ATTACK:enterprise:T1546

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--57a31238-b362-4c07-b8ae-45a619ece297

ATTACK:enterprise:T1546.015 → subtechnique-of → ATTACK:enterprise:T1546

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--670f37e1-8de3-441e-bc09-ff95c09ee14d

ATTACK:enterprise:T1546.004 → subtechnique-of → ATTACK:enterprise:T1546

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--786778a1-d043-49ad-bd73-1834b21f4ac1

ATTACK:enterprise:T1546.010 → subtechnique-of → ATTACK:enterprise:T1546

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--799eccf9-478d-421e-8f14-074b5546cb6a

ATTACK:enterprise:T1546.005 → subtechnique-of → ATTACK:enterprise:T1546

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7d244034-588d-4861-81ea-8c1db44f7055

ATTACK:enterprise:S1091 → uses → ATTACK:enterprise:T1546

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--804f7690-6bf2-41dc-a6d2-59c3d4394ce5

GitHub Pacu

ATTACK:enterprise:T1546.007 → subtechnique-of → ATTACK:enterprise:T1546

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--86c16ccf-cd37-4c5a-822b-034448056066

ATTACK:enterprise:T1546.012 → subtechnique-of → ATTACK:enterprise:T1546

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8a468c91-7863-4569-8e5f-a71cd565478e

ATTACK:enterprise:T1546.001 → subtechnique-of → ATTACK:enterprise:T1546

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8d5a5b8c-48a3-4d1c-bb39-89fd4a03bd15

ATTACK:enterprise:M1026 → mitigates → ATTACK:enterprise:T1546

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a3985a50-df7f-489f-a033-1a6b6e41382e

ATTACK:enterprise:T1546.009 → subtechnique-of → ATTACK:enterprise:T1546

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a72f9e78-41af-40c7-bce3-9e1e21d956e2

ATTACK:enterprise:C0035 → uses → ATTACK:enterprise:T1546

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bf492c3c-026c-45f3-bdc4-9ea200af2bb4

Lumen KVBotnet 2023

ATTACK:enterprise:T1546.017 → subtechnique-of → ATTACK:enterprise:T1546

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ce460e6d-9c29-4b1d-8a46-e4af52c9805c

ATTACK:enterprise:S1164 → uses → ATTACK:enterprise:T1546

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d61fe745-b222-48de-aa48-1b948780b9dd

Volexity UPSTYLE 2024

ATTACK:enterprise:T1546.014 → subtechnique-of → ATTACK:enterprise:T1546

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--da407f63-38cf-4247-b0bc-967ce74a2d78

ATTACK:enterprise:T1546.008 → subtechnique-of → ATTACK:enterprise:T1546

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e525352e-0d7e-41e4-bb35-9c50f9ef39c6

ATTACK:enterprise:S0658 → uses → ATTACK:enterprise:T1546

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e939c173-65a4-453e-b45e-d3cbef9b10dd

Microsoft March 2025 XCSSET · April 2021 TrendMicro XCSSET

ATTACK:enterprise:S9043 → uses → ATTACK:enterprise:T1546

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--efc15678-c8f8-4225-98bb-f9d070e163fe

Flashpoint Mini Shai-Hulud MAY 2026

ATTACK:enterprise:M1051 → mitigates → ATTACK:enterprise:T1546

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fc2f3e79-2740-4113-9875-4193b532d73e

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.