T1546Event Triggered Execution
T1546 — Event Triggered Execution is a MITRE ATT&CK technique in the Privilege Escalation tactic. Clankerusecase tracks 40 detection use cases covering it and 30 threat-intel articles citing it.
Privilege EscalationPersistence
40Use cases
30Articles
18Sub-techniques
2Tactics
Sub-techniques (18)
T1546.008 · Accessibility FeaturesT1546.009 · AppCert DLLsT1546.010 · AppInit DLLsT1546.011 · Application ShimmingT1546.001 · Change Default File AssociationT1546.015 · Component Object Model HijackingT1546.014 · EmondT1546.012 · Image File Execution Options InjectionT1546.016 · Installer PackagesT1546.006 · LC_LOAD_DYLIB AdditionT1546.007 · Netsh Helper DLLT1546.013 · PowerShell ProfileT1546.018 · Python Startup HooksT1546.002 · ScreensaverT1546.005 · TrapT1546.017 · Udev RulesT1546.004 · Unix Shell Configuration ModificationT1546.003 · Windows Management Instrumentation Event Subscription
Use cases covering this technique (40)
[WEEKLY] Package install lifecycle hook spawns interpreter that reads developer credential stores Windows AD AdminSDHolder ACL Modified Windows Compatibility Telemetry Suspicious Child Process Windows Compatibility Telemetry Tampering Through Registry [LLM] Shai-Hulud npm worm — shai-hulud-workflow.yml dropped into .github/workflows/ [LLM] PeopleSoft XMLDecoder persistence — XML file changes under envmetadata/data/environment [LLM] Editor/AI tool auto-execute config file dropped into project tree by package manager or git [LLM] VS Code/Cursor/Claude/Gemini spawns interpreter referencing folderOpen or SessionStart hook script [LLM] Malicious AI coding-agent hook configs written to repo (.claude/.gemini/.cursor/.vscode) [LLM] node.exe spawned by Code/Cursor/Claude/Gemini executing .github/setup.js [LLM] Miasma loader artifact written to Python site-packages: .pth, _index.js, .abi3.so [LLM] Hades persistence: *-setup.pth file written into Python site-packages [LLM] Kitty cat.py Python Backdoor File Drop / Execution (Nx Console Compromise) [LLM] Shai-Hulud worm GitHub Action workflow file dropped under .github/workflows [LLM] Compromised laravel-lang Composer package: helpers.php in vendor tree [LLM] Postinstall script execution from compromised @opensearch-project/opensearch package [LLM] Mini Shai-Hulud persistence hooks written into .vscode/ and .claude/ configs [LLM] Mini Shai-Hulud Claude Code SessionStart hook injection via npm install [LLM] VS Code tasks.json folderOpen persistence written by npm install chain [LLM] Mini Shai-Hulud Linux daemon persistence: kitty/cat.py and systemd user service [LLM] Mini Shai-Hulud router_init.js dropped at npm package root in node_modules [LLM] Bun spawned with tanstack_runner.js via npm prepare lifecycle (Mini Shai-Hulud) [LLM] Mini Shai-Hulud persistence to ~/.claude/hooks and .vscode/tasks.json by node/npm/bun [LLM] Shai-Hulud AI coding-agent persistence: .claude/settings.json + .vscode/tasks.json drops [LLM] Malicious elementary.pth dropped in Python site-packages [LLM] Mini Shai-Hulud post-compromise persistence artifacts in .claude/, .vscode/, .github/workflows/ [LLM] TeamPCP sysmon.py systemd-user persistence on developer host [LLM] Force-install of IDE extension via cmd.exe with --install-extension flag spawned by node host [LLM] litellm_init.pth Python autoload persistence drop [LLM] Malicious litellm_init.pth dropped to site-packages by pip (litellm==1.82.8 install artifact) [LLM] npm postinstall hook spawning node init.js or child.js (React Native attack pattern) [LLM] Secondary payload install: 'npm install -g openclaw' postinstall hook execution [LLM] npm/yarn/pnpm/bun lifecycle hook spawning shell or network LOLBin [LLM] Sha1-Hulud npm Worm — Drop of setup_bun.js / bun_environment.js / discussion.yaml by node or shell [LLM] Bun/Node executing the Sha1-Hulud worm payload (setup_bun.js / bun_environment.js) [LLM] Sha1-Hulud self-hosted GitHub Actions runner deployed under ~/.dev-env (SHA1HULUD) [LLM] Shai-Hulud bundle.js dropped on disk (SHA256 + filename hunt) [LLM] GhostAction malicious workflow file added with curl POST to Plesk infrastructure [LLM] Shai-Hulud persistence artifact: shai-hulud-workflow.yml file dropped on disk [LLM] cups-browsed writing new PPD or config under /etc/cups or /var/cache/cupsArticles citing this technique (30)
crit ShinyHunters Exploits Oracle PeopleSoft Zero-Day (CVE-2026-35273) to Breach Universities art-37
high Miasma and Hades Are Spreading Now: Detect Them on Developer Machines with Suspicious Files art-45
crit Mini Shai-Hulud Is Back: npm Worm Hits over 160 Packages, including Mistral and Tanstack art-315
high "A Mini Shai-Hulud Has Appeared": Bun-Based Stealer Hits SAP @cap-js and mbt npm Packages art-348