Activity timeline
T1546.003 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-09 with 4 reports, and 10 of the 10 threats were reported in the twelve months to 2026-10.
How adversaries use it
T1546.003 Windows Management Instrumentation Event Subscription is catalogued by MITRE ATT&CK under the Persistence and Privilege Escalation tactics in the Enterprise matrix, as a sub-technique of T1546 Event Triggered Execution. Threadlinqs maps 10 of 3416 tracked threats (0.3%) to it; by severity that is 4 high, 6 medium.
Threats that use T1546.003 most often also use T1053.005 Scheduled Task (8 threats), T1547.001 Registry Run Keys / Startup Folder (7 threats), T1685 Disable or Modify Tools (7 threats), T1005 Data from Local System (6 threats), T1059.001 PowerShell (6 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
2 tracked threat actors appear in the threats that use T1546.003; the most frequent are Aurora ransomware affiliate (1), GTG-50014 (1).
Threat actors using it
Tracked threats
10 tracked threats use T1546.003.
- Hermes Stealer: Russian-Market Malware-as-a-Service Platform and PyMapper Distribution Chainmedium
- AI-Enabled Ransomware and Extortion Economics: Stolen AI Credentials, Aurora Ransomware and GTG-50014…high
- CLOSEDQUORUM: First Reported Autonomous AI-Driven C2 Implant Using LLM Plurality Voting (Windows Infostealer)medium
- ClosedQuorum: Go-Based Windows Implant Delegates Post-Compromise Decisions to a Four-Model LLM Voting Panelmedium
- Cisco Talos Open-Sources CAIRN to Hunt AI-Integrated Malware; Discloses CLOSEDQUORUM, First Documented…medium
- PowerShell Cryptomining Loader Abuses Registry-Resident Scripts, DNS TXT Records, and PNG/WAV Steganography…medium
- Crimeware-as-a-Service: Inside the Malware Crypting Services Market and Its Threat Actorshigh
- Gemini CLI Abused as Autonomous AI Hacking Agent to Build and Operate "Patriot Bait" (bandcampro) C2 Botnet…medium
- "Patriot Bait": Solo Threat Actor 'bandcampro' Runs 5-Year AI-Automated Telegram Influence-and-Fraud Campaignhigh
- CVE-2026-20841: Command Injection in Windows Notepad Markdown Link Handling Enables Arbitrary Code Executionhigh
Detection coverage
Threadlinqs maintains 22 detection rules mapped to T1546.003 (SPL 8, KQL 6, Sigma 8). Rule content is available to Blue tier accounts and above; this page shows counts only.
Parent technique
T1546 Event Triggered Execution — 150 tracked threats at the technique level.