Skip to main content

Management / Monitoring / Threats / DEV

Trigger Malicious Code

CCC.Monitor.TH07

If a malicious actor is able to create new triggers, they would be able to use valid metric data to trigger malicious actions and re-compromise a newly replaced container or compute instance.

Related Capabilities

IDTitleDescription
CCC.Monitoring.CP01CCC.Monitoring.CP01
CCC.Monitoring.CP10CCC.Monitoring.CP10
CCC.Monitoring.CP11CCC.Monitoring.CP11

External Mappings

FrameworkIDRemarks
MITRE-ATT&CKT1546Event Triggered Execution