T1072 — Software Deployment Tools

Tactics: Execution, Lateral Movement · Platforms: Linux, macOS, Network Devices, SaaS, Windows

Adversaries may gain access to and use centralized software suites installed within an enterprise to execute commands and move laterally through the network. Configuration management and software deployment applications may be used in an enterprise network or cloud environment for routine…

Sigma detection rules (5)

title: T1072 Software Deployment Tools
id: d35fee3a-6f3b-4c6c-bb45-8fad45f5a3fc
description: 'Detection of Adversary Abuse of Software Deployment Tools. (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: ParentImageList, UserContext, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1072
author: Shahrukh Khan
date: 2026-02-09
license: MIT
tags:
  - attack.execution
  - attack.lateral-movement
  - attack.t1072

logsource:
  product: windows
  service: security

detection:
  selection:
    EventID: 4688
    NewProcessName|endswith:
      - '\ccmexec.exe'
      - '\ccmrepair.exe'
      - '\aexnsagent.exe'
      - '\aexagentutil.exe'
      - '\intunemanagementextension.exe'
      - '\pdqdeployrunner.exe'
      - '\psexec.exe'
      - '\psexesvc.exe'
  filter_system_account:
    SubjectUserName|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and not filter_system_account

falsepositives:
  - Legitimate SCCM/ConfigMgr, Altiris, Microsoft Intune, or PDQ Deploy activity, and authorized PsExec use by administrators; system and service accounts are excluded via filter_system_account. Tune further with parent-process and operator allowlists if noise remains.

level: medium

title: T1072 Software Deployment Tools
id: c2c6d567-3a7e-4351-9327-3766ec66bc95
description: 'Detection of Adversary Abuse of Software Deployment Tools. The prior version matched normal invocation of ansible-playbook/salt-call/puppet/chef-client with zero differentiating filter, firing identically on every routine config-management run, which its own falsepositives note admitted. Now requires either an interactive login session (auid set, atypical for CM-server-triggered automation) or a playbook/state/recipe path under a non-standard writable location (/tmp, /dev/shm, /var/tmp, /home) instead of the normal CM tree. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: DeployingHostAllowList, ScriptExecutionBaseline.'
references:
  - https://attack.mitre.org/techniques/T1072
author: Shahrukh Khan
date: 2026-04-02
license: MIT
tags:
  - attack.execution
  - attack.lateral-movement
  - attack.t1072

logsource:
  category: process_creation
  product: linux
  service: auditd

detection:
  selection_tool:
    type: EXECVE
    a0|endswith:
      - '/ansible-playbook'
      - '/salt-call'
      - '/puppet'
      - '/chef-client'
  filter_automated_context:
    type: SYSCALL
    auid: '4294967295'
  selection_nonstandard_path:
    - type: EXECVE
      a1|contains:
        - '/tmp/'
        - '/dev/shm/'
        - '/var/tmp/'
        - '/home/'
    - type: EXECVE
      a2|contains:
        - '/tmp/'
        - '/dev/shm/'
        - '/var/tmp/'
        - '/home/'

  condition: selection_tool and (not filter_automated_context or selection_nonstandard_path)

falsepositives:
  - These are the normal, expected commands run by configuration-management infrastructure when triggered non-interactively; scope alerts to hosts not enrolled as management targets, or execution from unexpected accounts/interactive sessions.

level: medium

title: T1072 Software Deployment Tools
id: fb49ed76-8415-4c86-b0f8-673cad9e268c
description: 'Detection of Adversary Abuse of Software Deployment Tools. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: SigningAuthorityList, RemoteCommandInterval.'
references:
  - https://attack.mitre.org/techniques/T1072
author: Shahrukh Khan
date: 2026-04-22
license: MIT
tags:
  - attack.execution
  - attack.lateral-movement
  - attack.t1072

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    ParentImage|contains:
      - '/Jamf.app'
      - '/Library/Application Support/JAMF'
      - 'ARDAgent'
      - 'Munki'
    Image|endswith:
      - '/bash'
      - '/zsh'
      - '/sh'

  condition: selection

falsepositives:
  - Legitimate Jamf or Munki policy execution routinely runs shell scripts through these same management parent processes.

level: high

title: T1072 Software Deployment Tools
id: af0d790d-b2e0-4d9b-98f7-d5d21ef16ddb
description: 'Detection of Adversary Abuse of Software Deployment Tools, scoped to anomalous invocation context rather than bare command-name matching. (Data Component: Command Execution; baseline tier: fallback.) Flags ansible-playbook/salt-call/puppet/chef-client/pssh executions that either run under a real interactive login session (auid set, atypical for CM-server-triggered automation) or reference a playbook/state/recipe path under a non-standard, world-writable location (/tmp, /dev/shm, /var/tmp, /home). Tune using: IAMRoleAllowList, ExecutionTargetList.'
references:
  - https://attack.mitre.org/techniques/T1072
author: Shahrukh Khan
date: 2026-03-13
license: MIT
tags:
  - attack.execution
  - attack.lateral-movement
  - attack.t1072

logsource:
  category: process_creation
  product: linux
  service: auditd

detection:
  selection_tool:
    type: EXECVE
    a0|endswith:
      - '/ansible-playbook'
      - '/salt-call'
      - '/puppet'
      - '/chef-client'
      - '/pssh'
    a1|contains:
      - '-i'
      - 'apply'
  filter_automated_context:
    type: SYSCALL
    auid: '4294967295'
  selection_nonstandard_path:
    - type: EXECVE
      a1|contains:
        - '/tmp/'
        - '/dev/shm/'
        - '/var/tmp/'
        - '/home/'
    - type: EXECVE
      a2|contains:
        - '/tmp/'
        - '/dev/shm/'
        - '/var/tmp/'
        - '/home/'

  condition: selection_tool and (not filter_automated_context or selection_nonstandard_path)

falsepositives:
  - Administrators who manually SSH into a host and run these CM tools interactively for troubleshooting will still trigger the auid-based condition; correlate with IAMRoleAllowList/ExecutionTargetList to suppress known-good admin accounts.
  - Legitimate playbooks/states occasionally staged under a user's home directory during testing before being moved to the standard CM tree.

level: medium

title: T1072 Software Deployment Tools
id: 79f4998d-808d-4c68-a0c3-91cb97fce92c
description: 'Detection of Adversary Abuse of Software Deployment Tools. (Data Component: Application Log Content; baseline tier: fallback.) Tune using: PushSourceAllowList, AuthUserPattern.'
references:
  - https://attack.mitre.org/techniques/T1072
author: Shahrukh Khan
date: 2026-03-16
license: MIT
tags:
  - attack.execution
  - attack.lateral-movement
  - attack.t1072

logsource:
  product: networkdevice
  service: syslog

detection:
  selection_push:
    Message|contains|all:
      - 'tftp'
      - 'copy'
  selection_deploy:
    Message|contains:
      - 'image install'
      - 'software install'
      - 'request system software add'
      - 'archive download-sw'
  condition: 1 of selection_*

falsepositives:
  - Scheduled firmware or configuration push from an approved network management or provisioning system.

level: medium

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1072 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan