Event Triggered Execution
Adversaries may establish persistence and/or elevate privileges using system mechanisms that trigger execution based on specific events. Various operating systems have means to monitor and subscribe to events such as logons or other user activity such as running specific applications/binaries. Cloud environments may also support various functions and services that monitor and can be invoked in response to specific cloud events.(Citation: Backdooring an AWS account)(Citation: Varonis Power Automa...
BY SOURCE
PROCEDURES (46)
Auto-extracted: 7 detections for persist
Auto-extracted: 4 detections for inject
Auto-extracted: 4 detections for registry
Auto-extracted: 3 detections for suspicious
Auto-extracted: 3 detections for registry monitoring
Auto-extracted: 2 detections for macro
Auto-extracted: 2 detections for wmi
Auto-extracted: 2 detections for macro
Auto-extracted: 2 detections for general monitoring
Auto-extracted: 2 detections for persist
Auto-extracted: 2 detections for service
Auto-extracted: 2 detections for child process
Auto-extracted: 2 detections for evasion
Auto-extracted: 2 detections for container
Auto-extracted: 2 detections for startup
Auto-extracted: 2 detections for parent process
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for unusual
Auto-extracted: 1 detections for base64
Auto-extracted: 1 detections for child process
Auto-extracted: 1 detections for exfiltrat
Auto-extracted: 1 detections for remote
Auto-extracted: 1 detections for remote
Auto-extracted: 1 detections for process creation monitoring
Auto-extracted: 1 detections for powershell
Auto-extracted: 1 detections for api
Auto-extracted: 1 detections for powershell
Auto-extracted: 1 detections for service
Auto-extracted: 1 detections for persist
Auto-extracted: 1 detections for download
Auto-extracted: 1 detections for persist
Auto-extracted: 1 detections for child process
Auto-extracted: 1 detections for authentication monitoring
Auto-extracted: 1 detections for script execution monitoring
Auto-extracted: 1 detections for service
Auto-extracted: 1 detections for aws
Auto-extracted: 1 detections for aws
Auto-extracted: 1 detections for aws
Auto-extracted: 1 detections for base64
Auto-extracted: 1 detections for cloud monitoring
Auto-extracted: 1 detections for persist
Auto-extracted: 1 detections for inject
Auto-extracted: 1 detections for privilege
Auto-extracted: 1 detections for container
Auto-extracted: 1 detections for registry
Auto-extracted: 1 detections for credential