T1546

← All KQL categories

MITRE ATT&CK Technique

T1546

2 queries tagged with this technique.
View on MITRE ATT&CK →

• Hunting Hunt Npm Postinstall Config Modification No User Context

  npm postinstall/lifecycle scripts that modified config without a corresponding interactive user command — AsyncAPI-shaped supply-chain compromise.

• Hunting Hunt Outlook Calendar C2 Far Future Standing Meeting

  Project CAV3RN's Outlook calendar C2 — standing meetings scheduled decades in the future in fixed low-attention windows, carrying operator-agent traffic in the event body.