T1546 Event Triggered Execution
Adversaries may establish persistence and/or elevate privileges using system mechanisms that trigger execution based on specific events. MITRE ATT&CK
3 Sigma rules T1546 on attack.mitre.org
Its sub-techniques
T1546.001Event Triggered Execution: Change Default File Association
T1546.002Event Triggered Execution: Screensaver
T1546.003Event Triggered Execution: Windows Management Instrumentation Event Subscription
T1546.007Event Triggered Execution: Netsh Helper DLL
T1546.008Event Triggered Execution: Accessibility Features
T1546.011Event Triggered Execution: Application Shimming
T1546.015Event Triggered Execution: Component Object Model Hijacking
Sigma rules tagged with it
Command lines CmdID reads as it
Use a file name to open a control panel item on the page for Show-ControlPanelItem
appwiz.cplIdentifyAn example is here when CmdID’s reading of it names T1546: a Sigma rule it trips is tagged with it, or its abuse is documented as it.