Event Triggered Execution T1546
Adversaries may establish persistence and/or elevate privileges using system mechanisms that trigger execution based on specific events. Various operating systems have means to monitor and subscribe to events such as logons or other user activity such as running specific applications/binaries.…
- Tactics
- Privilege Escalation, Persistence
- Actors using it
- 22
- Sub-techniques
- 8
Threat actors
- KimsukyNorth Korea · Black Banshee, Velvet Chollima, Emerald Sleet · 87 techniques
- APT28Russia · IRON TWILIGHT, SNAKEMACKEREL, Swallowtail · 73 techniques
- APT38North Korea · NICKEL GLADSTONE, BeagleBoyz, Bluenoroff · 70 techniques
- APT41China · Wicked Panda, Brass Typhoon, BARIUM · 66 techniques
- Mustang PandaChina · TA416, RedDelta, BRONZE PRESIDENT · 61 techniques
- FIN7GOLD NIAGARA, ITG14, Carbon Spider · 50 techniques
- TurlaRussia · IRON HUNTER, Group 88, Waterbug · 50 techniques
- APT29Russia · IRON RITUAL, IRON HEMLOCK, NobleBaron · 47 techniques
- APT3China · Gothic Panda, Pirpi, UPS Team · 40 techniques
- APT39Iran · ITG07, Chafer, Remix Kitten · 39 techniques
- LeviathanChina · MUDCARP, Kryptonite Panda, Gadolinium · 37 techniques
- Contagious InterviewDeceptiveDevelopment, Gwisin Gang, Tenacious Pungsan · 34 techniques
- Fox KittenIran · UNC757, Parisite, Pioneer Kitten · 31 techniques
- FIN8Syssphinx · 31 techniques
- TeamPCPPCPCat, ShellForce, DeadCatx3 · 30 techniques
- HEXANELyceum, Siamesekitten, Spirlin · 29 techniques
- APT33Iran · HOLMIUM, Elfin, Peach Sandstorm · 23 techniques
- Blue Mockingbird19 techniques
- AxiomChina · Group 72 · 15 techniques
- Deep PandaChina · Shell Crew, WebMasters, KungFu Kittens · 10 techniques
- Metador8 techniques
- Rancor8 techniques