Software Deployment Tools `T1072`

Tactics: Execution, Lateral Movement

Adversaries may gain access to and use centralized software suites installed within an enterprise to execute commands and move laterally through the network. Configuration management and software deployment applications may be used in an enterprise network or cloud environment for routine administration purposes. These systems may also be integrated into CI/CD pipelines. Examples of such solutions include: SCCM, HBSS, Altiris, AWS Systems Manager, Microsoft Intune, Azure Arc, and GCP Deployment Manager.

Events covered

10 catalog events are tagged with this technique by at least one rule.

Provider	Event	Title
Sysmon	Event ID 1	Process creation
Sysmon	Event ID 5	Process terminated
Security-Auditing	Event ID 4688	A new process has been created.
Security-Auditing	Event ID 4689	A process has exited.
ESF	exec	Process Execution
SoftwareRestrictionPolicies	Event ID 865	Access to AttemptedPath has been restricted by your Administrator by the default software restriction policy level.
SoftwareRestrictionPolicies	Event ID 866	Access to AttemptedPath has been restricted by your Administrator by location with policy rule SrpRuleGuid placed on path RulePath.
SoftwareRestrictionPolicies	Event ID 867	Access to AttemptedPath has been restricted by your Administrator by software publisher policy.
SoftwareRestrictionPolicies	Event ID 868	Access to AttemptedPath has been restricted by your Administrator by policy rule SrpRuleGuid.
SoftwareRestrictionPolicies	Event ID 882	Access to AttemptedPath has been restricted by your Administrator by policy rule SrpRuleGuid.

Authoring guide

These 30 rules share fields, values, and exclusions.

Fields filtered most (31 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`action`	6	`eq` 4, `in` 2	`completed`, `assigned`, `closed`, `converted_to_draft`, `edited`
`operationName`	6	`contains` 5, `in` 1	`* DeviceManagementConfigurationPolicy`, `DeviceHealthScript`, `ManagedDevice`, `MobileApp*`, `DeviceComplianceScript`
`CommandLine`	4	`contains` 2, `regex_match` 2	`(?i)\/connect\:.?\:`, ` /scomma `, ` /stext `, `https://jamf.*`
`OriginalFileName`	4	`eq` 4	`PDQDeployConsole.exe`, `Radmin.exe`, `csi.exe`, `psexec.c`, `rcsi.exe`
`sourcetype`	4	`eq` 4	`azure:monitor:activity`
`EventID`	3	`eq` 3	`4688`, `1`
`EventType`	3	`eq` 3	`exec`, `integration_installation.create`
`Image`	3	`contains` 1, `ends_with` 1, `starts_with` 1	`?:\Windows\SoftwareDistribution\Download\Install\*`, `Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}`, `Policies\{6AC1786C-016F-11D2-945F-00C04fB984F9}`, `\Device\HarddiskVolume?\Windows\SoftwareDistribution\Down...`, `\csi.exe`
`event.type`	3	`eq` 3	`start`
`process_basename`	3	`eq` 2, `in` 2	`apk`, `apt`, `apt-get`, `curl`, `nscurl`
`Company`	2	`eq` 2	`Microsoft Corporation`, `PDQ.com`
`Description`	2	`eq` 2	`PDQ Deploy Console`, `Radmin Viewer`
`Product`	2	`eq` 2	`PDQ Deploy`, `Radmin Viewer`
`parent_process_basename`	2	`eq` 1, `in` 1, `starts_with` 1	`node`, `osascript`, `perl`, `wuauclt.exe`
`process_name`	2	`regex_match` 2	`(?i)radmin`

Top indicator values (118 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`sourcetype`	`eq`	`azure:monitor:activity` splunkMicrosoft Intune Device Health Scripts splunkMicrosoft Intune DeviceManagementConfigurationPolicies splunkMicrosoft Intune Manual Device Management splunkMicrosoft Intune Mobile Apps	4	5
`action`	`eq`	`completed` pantherGitHub pull_request_target Workflow Usage pantherGitHub Workflow Contains Checkout Action pantherGitHub Workflow Using Self-Hosted Runner	3	4
`event.type`	`eq`	`start` elasticPotential WSUS Abuse for Lateral Movement elasticSuspicious Curl to Jamf Endpoint elasticTool Installation Detected via Defend for Containers	3	1036
`CommandLine`	`regex_match`	`(?i)\/connect\:.*?\:` splunkRadmin execution (Sysmon) splunkRadmin execution (Windows Event Log)	2	2
`EventType`	`eq`	`exec` elasticSuspicious Curl to Jamf Endpoint elasticTool Installation Detected via Defend for Containers	2	547
`EventType`	`eq`	`integration_installation.create` elasticNew GitHub App Installed	1
`action`	`in`	`edited` pantherGitHub Malicious Issue/Pages Content pantherGitHub Malicious Pull Request Content	2	3
`action`	`in`	`opened` pantherGitHub Malicious Issue/Pages Content pantherGitHub Malicious Pull Request Content	2	2
`process_name`	`regex_match`	`(?i)radmin` splunkRadmin execution (Sysmon) splunkRadmin execution (Windows Event Log)	2	2
`CommandLine`	`contains`	`* /scomma *` splunkDetection of tools built by NirSoft	1
`CommandLine`	`contains`	`* /stext *` splunkDetection of tools built by NirSoft	1
`CommandLine`	`contains`	`https://jamf.` elasticSuspicious Curl to Jamf Endpoint	1
`Company`	`eq`	`Microsoft Corporation` sigmaSuspicious Csi.exe Usage	1	2
`Company`	`eq`	`PDQ.com` sigmaPDQ Deploy Remote Adminstartion Tool Execution	1
`Description`	`eq`	`PDQ Deploy Console` sigmaPDQ Deploy Remote Adminstartion Tool Execution	1
`Description`	`eq`	`Radmin Viewer` sigmaPUA - Radmin Viewer Utility Execution	1
`EventID`	`eq`	`1` splunkRadmin execution (Sysmon)	1	226
`EventID`	`eq`	`4688` kustoNew EXE deployed via Default Domain or Default Domain Controller Policies	1	23
`EventID`	`eq`	`4688` splunkRadmin execution (Windows Event Log)	1	284
`Image`	`contains`	`Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}` kustoNew EXE deployed via Default Domain or Default Domain Controller Policies	1
`Image`	`contains`	`Policies\{6AC1786C-016F-11D2-945F-00C04fB984F9}` kustoNew EXE deployed via Default Domain or Default Domain Controller Policies	1
`Image`	`ends_with`	`\csi.exe` sigmaSuspicious Csi.exe Usage	1	2
`Image`	`ends_with`	`\rcsi.exe` sigmaSuspicious Csi.exe Usage	1
`Image`	`starts_with`	`?:\Windows\SoftwareDistribution\Download\Install\*` elasticPotential WSUS Abuse for Lateral Movement	1
`Image`	`starts_with`	`\Device\HarddiskVolume?\Windows\SoftwareDistribution\Download\Install\*` elasticPotential WSUS Abuse for Lateral Movement	1
`Malware`	`is_not_null`	kustoSAP BTP - Malware detected in BAS dev space	1
`Message`	`contains`	`malware` kustoSAP BTP - Malware detected in BAS dev space	1
`OperationName`	`eq`	`Release.ReleasePipelineCreated` kustoAzure DevOps Pipeline Created and Deleted on the Same Day	1
`OriginalFileName`	`eq`	`PDQDeployConsole.exe` sigmaPDQ Deploy Remote Adminstartion Tool Execution	1
`OriginalFileName`	`eq`	`csi.exe` sigmaSuspicious Csi.exe Usage	1	2

Exclusions (4 distinct)

These values appear most often in top-level exclusions.

Field	Kind	Value	Rules excluding
`Process`	`eq`	`known_processes` kustoNew EXE deployed via Default Domain or Default Domain Controller Policies kustoNew EXE deployed via Default Domain or Default Domain Controller Policies (ASIM Version)	2
`action`	`ne`	`opened` pantherGitHub Malicious Pull Request Content	1
`pages`	`is_null`	pantherGitHub Malicious Issue/Pages Content	1
`workflow_job.runner_name`	`starts_with`	`GitHub Actions` pantherGitHub Workflow Using Self-Hosted Runner	1

Software Deployment Tools `T1072`

Events covered

Authoring guide

Fields filtered most (31 distinct)

Top indicator values (118 distinct)

Exclusions (4 distinct)

Rules under this technique

Sigma 4 rules

Elastic 4 rules

Splunk 7 rules

Kusto 4 rules

Panther 11 rules

Software Deployment Tools T1072

Events covered

Authoring guide

Fields filtered most (31 distinct)

Top indicator values (118 distinct)

Exclusions (4 distinct)

Rules under this technique

Sigma 4 rules

Elastic 4 rules

Splunk 7 rules

Kusto 4 rules

Panther 11 rules

Software Deployment Tools `T1072`