T1072 Software Deployment Tools
Adversaries may gain access to and use centralized software suites installed within an enterprise to execute commands and move laterally through the network. Configuration management and software deployment applications may be used in an enterprise network or cloud environment for routine administration purposes. These systems may also be integrated into CI/CD pipelines. Examples of such…
Who uses it · with stories on Jábega
Sigma rules to hunt it
- Restricted Software Access By SRPhightest · windows
- PDQ Deploy Remote Adminstartion Tool Executionmediumtest · windows
- PUA - Radmin Viewer Utility Executionmediumtest · windows
- Suspicious Csi.exe Usagemediumtest · windows
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.