tfMITRE ATT&CK technique

Software Deployment Tools T1072

Tactics: Execution, Lateral Movement
Platforms: Linux, macOS, Network Devices, SaaS, Windows
Version: 3.2
Created: 31 May 2017
Last modified: 12 May 2026
Contributors: Shane Tully, @securitygypsy; Joe Gumke, U.S. Bank; Tamir Yehuda

Adversaries may gain access to and use centralized software suites installed within an enterprise to execute commands and move laterally through the network. Configuration management and software deployment applications may be used in an enterprise network or cloud environment for routine administration purposes. These systems may also be integrated into CI/CD pipelines. Examples of such solutions include: SCCM, HBSS, Altiris, AWS Systems Manager, Microsoft Intune, Azure Arc, and GCP Deployment Manager.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 21%

Threat groups79th percentile · 77% of ATT&CK techniques have fewer threat groups attributed.

Campaigns72nd pct

Campaigns72nd percentile · 54% of ATT&CK techniques have fewer campaigns recorded.

Tools & malware44th pct

Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.

Detection rules72nd pct

Detection rules72nd percentile · 69% of ATT&CK techniques have fewer detection rules written.

Offense vs defense T1072

Compare defenses against adversary use. Eight counts, ranking this technique against the entire ATT&CK Enterprise matrix. Attack sits left, defense right.

Range

Technique Campaign use over its cumulative rule count.

Campaigns · 1Sigma rules (cumulative) · 4Splunk ESCU (cumulative) · 4

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Security	EventCode=4688
Application Log ContentDC0038	WinEventLog:Application	SCCM, Intune logs

Data component

Name

Channel

Process CreationDC0032

WinEventLog:Security

EventCode=4688

Application Log ContentDC0038

WinEventLog:Application

SCCM, Intune logs

Field	What you tune
ParentImageList	Allowlist of known SCCM-related binary spawners (e.g., 'CCMExec.exe')
UserContext	Expected deployment activity from scheduled system accounts
TimeWindow	Unusual deployment timing outside standard maintenance hours

Field

What you tune

ParentImageList

Allowlist of known SCCM-related binary spawners (e.g., 'CCMExec.exe')

UserContext

Expected deployment activity from scheduled system accounts

TimeWindow

Unusual deployment timing outside standard maintenance hours

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	execve

Field	What you tune
DeployingHostAllowList	Approved orchestration or jump box IPs
ScriptExecutionBaseline	Expected scripts, interpreters, or package managers used

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	process and signing chain events
Application Log ContentDC0038	macos:jamf	RemoteCommandExecution

Field	What you tune
SigningAuthorityList	Expected signing authorities for JAMF and MDM scripts
RemoteCommandInterval	Frequency of remote execution from MDM servers

Data component	Name	Channel
Command ExecutionDC0064	AWS:CloudTrail	SSM RunCommand

Field	What you tune
IAMRoleAllowList	Approved deployment administrators or service accounts
ExecutionTargetList	Expected endpoints targeted by SaaS deployments

Data component	Name	Channel
Application Log ContentDC0038	networkdevice:syslog	config push events
Network Traffic FlowDC0078	NSM:Flow	Device-to-Device Deployment Flows

Field	What you tune
PushSourceAllowList	Devices or IPs allowed to push firmware or scripts
AuthUserPattern	Expected CLI or API user performing configuration

Offense vs defense T1072

Compare defenses against adversary use. Eight counts, ranking this technique against the entire ATT&CK Enterprise matrix. Attack sits left, defense right.

Range

Technique Campaign use over its cumulative rule count.

Campaigns · 1Sigma rules (cumulative) · 4Splunk ESCU (cumulative) · 4

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Security	EventCode=4688
Application Log ContentDC0038	WinEventLog:Application	SCCM, Intune logs

Data component

Name

Channel

Process CreationDC0032

WinEventLog:Security

EventCode=4688

Application Log ContentDC0038

WinEventLog:Application

SCCM, Intune logs

Field	What you tune
ParentImageList	Allowlist of known SCCM-related binary spawners (e.g., 'CCMExec.exe')
UserContext	Expected deployment activity from scheduled system accounts
TimeWindow	Unusual deployment timing outside standard maintenance hours

Field

What you tune

ParentImageList

Allowlist of known SCCM-related binary spawners (e.g., 'CCMExec.exe')

UserContext

Expected deployment activity from scheduled system accounts

TimeWindow

Unusual deployment timing outside standard maintenance hours

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	execve

Field	What you tune
DeployingHostAllowList	Approved orchestration or jump box IPs
ScriptExecutionBaseline	Expected scripts, interpreters, or package managers used

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	process and signing chain events
Application Log ContentDC0038	macos:jamf	RemoteCommandExecution

Field	What you tune
SigningAuthorityList	Expected signing authorities for JAMF and MDM scripts
RemoteCommandInterval	Frequency of remote execution from MDM servers

Data component	Name	Channel
Command ExecutionDC0064	AWS:CloudTrail	SSM RunCommand

Field	What you tune
IAMRoleAllowList	Approved deployment administrators or service accounts
ExecutionTargetList	Expected endpoints targeted by SaaS deployments

Data component	Name	Channel
Application Log ContentDC0038	networkdevice:syslog	config push events
Network Traffic FlowDC0078	NSM:Flow	Device-to-Device Deployment Flows

Field	What you tune
PushSourceAllowList	Devices or IPs allowed to push firmware or scripts
AuthUserPattern	Expected CLI or API user performing configuration

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID
Splunk	Microsoft Intune device remediation scripts are a tool administrators can use to remotely manage devices, this functionality can also be abused for SYSTEM level code execution and lateral movement to intune managed devices. (...)	Hunting	stable	cloud_audit	-	Azure	Stealth Indirect Command Execution Command and Control Ingress Tool Transfer Lateral Movement Remote Services Cloud Services Execution, Lateral Movement Software Deployment Tools	-	medium	Dean Luxton	2025-01-06	2026-05-13	6fe42e07-15b1-4caa-b547-7885666cb1bd
Splunk	Microsoft Intune device management configuration policies are a tool administrators can use to remotely manage policies and settings on intune managed devices. (...)	Hunting	stable	cloud_audit	-	Azure	Defense Impairment Disable or Modify System Firewall Defense Impairment Disable or Modify Tools Privilege Escalation, Defense Impairment Domain or Tenant Policy Modification Lateral Movement Remote Services Cloud Services Execution, Lateral Movement Software Deployment Tools	-	medium	Dean Luxton	2025-01-06	2026-05-13	3c49e5ed-625c-408c-a2c7-8e2b524efb2c
Splunk	Microsoft Intune device management configuration policies, scripts & apps are a all tools administrators can use to remotely manage intune managed devices. (...)	Hunting	stable	cloud_audit	-	Azure	Lateral Movement Remote Services Cloud Services Execution, Lateral Movement Software Deployment Tools Impact System Shutdown/Reboot	-	medium	Dean Luxton	2025-01-06	2026-05-13	5ca7ebee-4ee7-4cf2-b3be-0ea26a00d822
Splunk	Microsoft Intune supports deploying packaged applications to support software deployment, this functionality can also be abused for deploying malicious payloads to intune managed devices. (...)	Hunting	experimental	cloud_audit	-	Azure	Stealth Indirect Command Execution Command and Control Ingress Tool Transfer Lateral Movement Remote Services Cloud Services Execution, Lateral Movement Software Deployment Tools	-	medium	Dean Luxton	2025-01-06	2026-05-13	98e6b389-2806-4426-a580-8a92cb0d9710
	Detect use of PDQ Deploy remote admin tool	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution, Lateral Movement Software Deployment Tools	-	medium	frack113	2022-10-01	2023-01-30	d679950c-abb7-43a6-80fb-2a480c4fc450
	Detects the execution of Radmin which can be abused by an adversary to remotely control Windows mach (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution, Lateral Movement Software Deployment Tools	-	medium	frack113	2022-01-22	2023-12-11	5817e76f-4804-41e6-8f1d-5fa0b3ecae2d
	Detects restricted access to applications by the Software Restriction Policies (SRP) policy	Generic	test	-	windows	WinEventLog Application	Execution, Lateral Movement Software Deployment Tools	-	high	frack113	2023-01-12	—	b4c8da4a-1c12-46b0-8a2b-0a8521d03442
	Csi.exe is a signed binary from Microsoft that comes with Visual Studio and provides C# interactive capabilities. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution, Lateral Movement Software Deployment Tools Stealth System Binary Proxy Execution	-	medium	Konstantin Grishchenko, oscd.community	2020-10-17	2022-07-11	40b95d31-1afc-469e-8d34-9a3a667d058e

Title

Description

Software Deployment Tools T1072

Software Deployment Tools T1072

Software Deployment Tools MITRE reference T1072

Offense vs defense T1072

Software Deployment Tools detection strategy DET0223

Detection of Adversary Abuse of Software Deployment Tools

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Software Deployment Tools MITRE reference T1072

Offense vs defense T1072

Software Deployment Tools detection strategy DET0223

Detection of Adversary Abuse of Software Deployment Tools

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Software Deployment Tools detections T1072

Software Deployment Tools detections T1072