ShinyHuntersG1057 ↗
Has abused software deployment tools for lateral movement.1
tfMITRE ATT&CK technique
Software Deployment Tools T1072
- Tactics
- Execution, Lateral Movement
- Platforms
- Linux, macOS, Network Devices, SaaS, Windows
- Version
- 3.2
- Created
- 31 May 2017
- Last modified
- 12 May 2026
- Contributors
- Shane Tully, @securitygypsy; Joe Gumke, U.S. Bank; Tamir Yehuda
Adversaries may gain access to and use centralized software suites installed within an enterprise to execute commands and move laterally through the network. Configuration management and software deployment applications may be used in an enterprise network or cloud environment for routine administration purposes. These systems may also be integrated into CI/CD pipelines. Examples of such solutions include: SCCM, HBSS, Altiris, AWS Systems Manager, Microsoft Intune, Azure Arc, and GCP Deployment Manager.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
8
Threat groupsTop 21%
Threat groups79th percentile · 79% of ATT&CK techniques have this many threat groups attributed or fewer.1
Campaigns72nd pct
Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.1
Tools & malware44th pct
Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.9
Detection rules73rd pct
Detection rules73rd percentile · 73% of ATT&CK techniques have this many detection rules written or fewer.Software Deployment Tools MITRE reference T1072
Top 21%of all ATT&CK techniques for number of groups
8 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
VOID MANTICOREG1055 ↗
Has leveraged legitimate built-in features of cloud-based management platforms to include mobile device management (MDM) and Remote Monitoring and Management (RMM) solutions.12 VOID MANTICORE has also initiated built-in remote wipe instructions using a privileged account within Microsoft Intune.12
Medusa GroupG1051 ↗
Has utilized software deployment and management solutions to deploy their encryption payload to include BigFix and PDQ Deploy.1
Mustang PandaG0129 ↗
Has leveraged legitimate software tools such as AntiVirus Agents, Security Services, and App Development tools to execute scripts and to side-load dlls.12
SilenceG0091 ↗
Has used RAdmin, a remote software tool used to remotely control workstations and ATMs.1
APT32G0050 ↗
Compromised McAfee ePO to move laterally by distributing malware as a software deployment task.1
All 8 groups for this technique · 6 newest in this preview
1 campaign has been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
C0018C0018 ↗
During C0018, the threat actors used PDQ Deploy to move AvosLocker and tools across the network.1
All 1 campaigns for this technique
1 software entry is documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
WiperS0041 ↗
It is believed that a patch management system for an anti-virus product commonly installed among targeted companies was used to distribute the Wiper malware.1
All 1 software entries for this technique
Offense vs defense T1072
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 1Sigma rules (cumulative) · 4Splunk ESCU (cumulative) · 5
first rule: 2020 Q2 · 1 of 1 campaigns plottedSoftware Deployment Tools detection strategy DET0223
MITRE names one behaviour worth catching for this technique and breaks it into 5 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection of Adversary Abuse of Software Deployment Tools
5 platforms
AN0623 · Windows
Detects SCCM, Intune, or remote push execution spawning scripts or binaries from SYSTEM context or unusual consoles (e.g., cmtrace.exe launching PowerShell or cmd.exe).
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog:Security | EventCode=4688 |
| Application Log ContentDC0038 | WinEventLog:Application | SCCM, Intune logs |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ParentImageList | Allowlist of known SCCM-related binary spawners (e.g., 'CCMExec.exe') |
| UserContext | Expected deployment activity from scheduled system accounts |
| TimeWindow | Unusual deployment timing outside standard maintenance hours |
AN0624 · Linux
Detects remote scripts or binaries deployed via Puppet, Chef, Ansible, or shell scripts from orchestration servers executing outside maintenance windows or in unmanaged nodes.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | auditd:SYSCALL | execve |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| DeployingHostAllowList | Approved orchestration or jump box IPs |
| ScriptExecutionBaseline | Expected scripts, interpreters, or package managers used |
AN0625 · macOS
Detects script or binary execution initiated via JAMF, Munki, or custom MDM agents outside of baseline, or JAMF launching new Terminal or osascript processes from remote command payloads.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | macos:unifiedlog | process and signing chain events |
| Application Log ContentDC0038 | macos:jamf | RemoteCommandExecution |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| SigningAuthorityList | Expected signing authorities for JAMF and MDM scripts |
| RemoteCommandInterval | Frequency of remote execution from MDM servers |
AN0626 · SaaS
Detects cloud-native software deployment or management (e.g., SSM Run Command, Intune) initiating script execution on endpoints outside expected org IDs, admin groups, or maintenance windows.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Command ExecutionDC0064 | AWS:CloudTrail | SSM RunCommand |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| IAMRoleAllowList | Approved deployment administrators or service accounts |
| ExecutionTargetList | Expected endpoints targeted by SaaS deployments |
AN0627 · Network Devices
Detects central router or switch config management tools (e.g., FortiManager, Cisco Prime) triggering device reboots or config pushes using abnormal accounts or IPs.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Application Log ContentDC0038 | networkdevice:syslog | config push events |
| Network Traffic FlowDC0078 | NSM:Flow | Device-to-Device Deployment Flows |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| PushSourceAllowList | Devices or IPs allowed to push firmware or scripts |
| AuthUserPattern | Expected CLI or API user performing configuration |
Ensure proper system and access isolation for critical network systems through use of group policy.
Restrict the use of third-party software suites installed within an enterprise network.
Ensure proper system and access isolation for critical network systems through use of multi-factor authentication.
Network SegmentationM1030
Ensure proper system isolation for critical network systems through use of firewalls.
Password PoliciesM1027
Verify that account credentials that may be used to access deployment systems are unique and not used throughout the enterprise network.
Grant access to application deployment systems only to a limited number of authorized administrators.
Remote Data StorageM1029
If the application deployment system can be configured to deploy only signed binaries, then ensure that the trusted signing certificates are not co-located with the application deployment system and are instead located on a system that cannot be accessed remotely or to which remote access is tightly controlled.
Update SoftwareM1051
Patch deployment systems regularly to prevent potential remote access through Exploitation for Privilege Escalation.
Ensure that any accounts used by third-party providers to access these systems are traceable to the third-party and are not used throughout the network or used by other third-party providers in the same environment. Ensure there are regular reviews of accounts provisioned to these systems to verify continued business need, and ensure there is governance to trace de-provisioning of access that is no longer required. Ensure proper system and access isolation for critical network systems through use of account privilege separation.
User TrainingM1017
Have a strict approval policy for use of deployment systems.
Tests3Executorscmd 2 · PowerShell 1Need elevation2 of 3Have prerequisites3Have cleanup0Platformswindows
Tests from Atomic Red Team (MIT licence) · technique definition