{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1072","id":"T1072","name":"Software Deployment Tools","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1072","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"c1a772ae84f17f7f3c336a0975432124d3149089abadde6bd32c9ab2d26dfab9","description":"Adversaries may gain access to and use centralized software suites installed within an enterprise to execute commands and move laterally through the network. Configuration management and software deployment applications may be used in an enterprise network or cloud environment for routine administration purposes. These systems may also be integrated into CI/CD pipelines. Examples of such solutions include: SCCM, HBSS, Altiris, AWS Systems Manager, Microsoft Intune, Azure Arc, and GCP Deployment Manager.  \n\nAccess to network-wide or enterprise-wide endpoint management software may enable an adversary to achieve remote code execution on all connected systems. The access may be used to laterally move to other systems, gather information, or cause a specific effect, such as wiping the hard drives on all endpoints.\n\nSaaS-based configuration management services may allow for broad [Cloud Administration Command](https://attack.mitre.org/techniques/T1651) on cloud-hosted instances, as well as the execution of arbitrary commands on on-premises endpoints. For example, Microsoft Configuration Manager allows Global or Intune Administrators to run scripts as SYSTEM on on-premises devices joined to Entra ID.(Citation: SpecterOps Lateral Movement from Azure to On-Prem AD 2020) Such services may also utilize [Web Protocols](https://attack.mitre.org/techniques/T1071/001) to communicate back to adversary owned infrastructure.(Citation: Mitiga Security Advisory: SSM Agent as Remote Access Trojan)\n\nNetwork infrastructure devices may also have configuration management tools that can be similarly abused by adversaries.(Citation: Fortinet Zero-Day and Custom Malware Used by Suspected Chinese Actor in Espionage Operation)\n\nThe permissions required for this action vary by system configuration; local credentials may be sufficient with direct access to the third-party system, or specific domain credentials may be required. However, the system may require an administrative account to log in or to access specific functionality.","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1072","external_id":"T1072"},{"source_name":"Fortinet Zero-Day and Custom Malware Used by Suspected Chinese Actor in Espionage Operation","description":"ALEXANDER MARVI, BRAD SLAYBAUGH, DAN EBREO, TUFAIL AHMED, MUHAMMAD UMAIR, TINA JOHNSON. (2023, March 16). Fortinet Zero-Day and Custom Malware Used by Suspected Chinese Actor in Espionage Operation. Retrieved May 15, 2023.","url":"https://www.mandiant.com/resources/blog/fortinet-malware-ecosystem"},{"source_name":"SpecterOps Lateral Movement from Azure to On-Prem AD 2020","description":"Andy Robbins. (2020, August 17). Death from Above: Lateral Movement from Azure to On-Prem AD. Retrieved March 13, 2023.","url":"https://posts.specterops.io/death-from-above-lateral-movement-from-azure-to-on-prem-ad-d18cb3959d4d"},{"source_name":"Mitiga Security Advisory: SSM Agent as Remote Access Trojan","description":"Ariel Szarf, Or Aspir. (n.d.). Mitiga Security Advisory: Abusing the SSM Agent as a Remote Access Trojan. Retrieved January 31, 2024.","url":"https://www.mitiga.io/blog/mitiga-security-advisory-abusing-the-ssm-agent-as-a-remote-access-trojan"}],"platforms":["Linux","macOS","Network Devices","SaaS","Windows"],"environments":["cloud","cloud-hosted-endpoint","network-infrastructure","onprem","saas"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0038","name":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component","category":"Application and service audit","description":"Application-emitted audit or operational event content.","collection_focus":"Select the application event family required by the detection and document its native schema before normalization.","providers":[{"name":"Application audit logs","scope":"First-party service events and request/result fields; schema is application-specific.","source_id":"otel"},{"name":"OpenTelemetry-compatible log pipelines","scope":"Transport and normalization of emitted records; do not create missing audit instrumentation.","source_id":"otel"}],"configuration":["Enable the application audit category or instrument the owned lab application at the authorization/action boundary.","Define a schema with timestamp, service, actor, object, action, result and correlation ID. Export structured records through an authenticated collector.","Redact secrets and personal content, separate audit from debug logs, set retention and verify delivery during rotation/restart."],"configuration_example":null,"required_fields":["service","action","actor","record_count","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Debug output is not necessarily a durable audit trail. Application developers must emit the relevant event; installing a log pipeline does not make an absent event exist.","sources":[{"id":"otel","title":"OpenTelemetry log data model","url":"https://opentelemetry.io/docs/specs/otel/logs/data-model/"}],"association":"attack_component","anomaly_design":"Per application, client and route: request rate, rare actions, failure ratios and unusual state transitions. Version changes, retries, health probes and seasonal load need separate baselines."},{"id":"DC0064","name":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component","category":"Script and command execution","description":"Execution of a command and its interpreter or parent context.","collection_focus":"Collect process command lines and relevant shell/interpreter audit; shell history alone is neither complete nor tamper-resistant.","providers":[{"name":"PowerShell Script Block Logging","scope":"Script content via event 4104 when configured; channel depends on PowerShell edition.","source_id":"powershell"},{"name":"Sysmon process events","scope":"Interpreter launch and parent context, not full script content.","source_id":"sysmon"},{"name":"Linux Audit","scope":"execve-family execution context; shell built-ins need additional instrumentation.","source_id":"linux"}],"configuration":["Enable Script Block Logging through the policy/configuration for the installed edition. Forward Microsoft-Windows-PowerShell/Operational for Windows PowerShell, or PowerShellCore/Operational for PowerShell 7.","Retain script-block ID and fragment ordering alongside process creation. Protect access to collected script text; secrets may be included.","On Linux, use narrowly scoped Audit execution rules for the lab account and supported architectures, and retain joined SYSCALL/EXECVE/PATH records."],"configuration_example":null,"required_fields":["interpreter","command_line","actor_uid","session_id"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Script content and process command lines are different signals. Logging may be partial, fragmented, filtered or disabled; never assume a command line reveals everything executed.","sources":[{"id":"powershell","title":"Microsoft PowerShell logging on Windows","url":"https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows?view=powershell-7.5"},{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Per host role and principal: rare interpreters, command argument patterns and parent-child sequences. Normalize scripts carefully; obfuscation, administrative automation and missing command lines change visibility."},{"id":"DC0078","name":"Network Traffic Flow","page":"telemetry/DC0078/","kind":"attack_component","category":"Network and protocol telemetry","description":"Connection/flow summaries such as endpoints, duration, byte counts and transport.","collection_focus":"Collect Zeek conn.log, Suricata flow events or exporter equivalents, including observation point and sampling settings.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"},{"name":"AWS VPC Flow Logs","scope":"IP traffic metadata alternative; no packet payload or DNS answer history, and some traffic is not logged.","source_id":"flow"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["source_ip","destination_ip","destination_port","protocol","bytes_sent","bytes_received"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0078","collector":"illustrative-lab-collector","observation":{"source_ip":"192.0.2.10","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","bytes_sent":128,"bytes_received":512}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"},{"id":"flow","title":"AWS VPC Flow Logs","url":"https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."}],"detection":{"key":"enterprise/T1072","id":"T1072","name":"Software Deployment Tools","domain":"enterprise","platforms":["Linux","macOS","Network Devices","SaaS","Windows"],"environments":["cloud","cloud-hosted-endpoint","network-infrastructure","onprem","saas"],"source_url":"https://attack.mitre.org/techniques/T1072","technique_page":"techniques/enterprise/T1072/","page":"detections/enterprise/T1072/","status":"rule_source_available","counts":{"sigma":4,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":5,"live_validated":0},"sigma_rules":[{"id":"b4c8da4a-1c12-46b0-8a2b-0a8521d03442","title":"Restricted Software Access By SRP","status":"test","level":"high","logsource":{"product":"windows","service":"application"},"data_path":"data/detection-rules/b4c8da4a-1c12-46b0-8a2b-0a8521d03442.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/application/microsoft_windows_software_restriction_policies/win_software_restriction_policies_block.yml","author":"frack113","kind":"sigma"},{"id":"40b95d31-1afc-469e-8d34-9a3a667d058e","title":"Suspicious Csi.exe Usage","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/40b95d31-1afc-469e-8d34-9a3a667d058e.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_csi_execution.yml","author":"Konstantin Grishchenko, oscd.community","kind":"sigma"},{"id":"d679950c-abb7-43a6-80fb-2a480c4fc450","title":"PDQ Deploy Remote Adminstartion Tool Execution","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/d679950c-abb7-43a6-80fb-2a480c4fc450.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_pdqdeploy_execution.yml","author":"frack113","kind":"sigma"},{"id":"5817e76f-4804-41e6-8f1d-5fa0b3ecae2d","title":"PUA - Radmin Viewer Utility Execution","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/5817e76f-4804-41e6-8f1d-5fa0b3ecae2d.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_pua_radmin.yml","author":"frack113","kind":"sigma"}],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0223","name":"Detection of Adversary Abuse of Software Deployment Tools","url":"https://attack.mitre.org/detectionstrategies/DET0223","stix_id":"x-mitre-detection-strategy--ea1f5423-64b9-44eb-824f-251aa0faccd2","relationship_id":"relationship--9704367c-1ca3-4b41-b7b7-b3041f6fabbd","description":"","analytics":[{"id":"AN0623","name":"Analytic 0623","guidance":"Detects SCCM, Intune, or remote push execution spawning scripts or binaries from SYSTEM context or unusual consoles (e.g., cmtrace.exe launching PowerShell or cmd.exe).","url":"https://attack.mitre.org/detectionstrategies/DET0223#AN0623","platforms":["Windows"],"tuning":[{"field":"ParentImageList","description":"Allowlist of known SCCM-related binary spawners (e.g., 'CCMExec.exe')"},{"field":"UserContext","description":"Expected deployment activity from scheduled system accounts"},{"field":"TimeWindow","description":"Unusual deployment timing outside standard maintenance hours"}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Security","channel":"EventCode=4688","platforms":["Windows"],"analytic_id":"AN0623","source_url":"https://attack.mitre.org/detectionstrategies/DET0223#AN0623","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0038","component":"Application Log Content","name":"WinEventLog:Application","channel":"SCCM, Intune logs","platforms":["Windows"],"analytic_id":"AN0623","source_url":"https://attack.mitre.org/detectionstrategies/DET0223#AN0623","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"}]},{"id":"AN0624","name":"Analytic 0624","guidance":"Detects remote scripts or binaries deployed via Puppet, Chef, Ansible, or shell scripts from orchestration servers executing outside maintenance windows or in unmanaged nodes.","url":"https://attack.mitre.org/detectionstrategies/DET0223#AN0624","platforms":["Linux"],"tuning":[{"field":"DeployingHostAllowList","description":"Approved orchestration or jump box IPs"},{"field":"ScriptExecutionBaseline","description":"Expected scripts, interpreters, or package managers used"}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"auditd:SYSCALL","channel":"execve","platforms":["Linux"],"analytic_id":"AN0624","source_url":"https://attack.mitre.org/detectionstrategies/DET0223#AN0624","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"}]},{"id":"AN0625","name":"Analytic 0625","guidance":"Detects script or binary execution initiated via JAMF, Munki, or custom MDM agents outside of baseline, or JAMF launching new Terminal or osascript processes from remote command payloads.","url":"https://attack.mitre.org/detectionstrategies/DET0223#AN0625","platforms":["macOS"],"tuning":[{"field":"SigningAuthorityList","description":"Expected signing authorities for JAMF and MDM scripts"},{"field":"RemoteCommandInterval","description":"Frequency of remote execution from MDM servers"}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"macos:unifiedlog","channel":"process and signing chain events","platforms":["macOS"],"analytic_id":"AN0625","source_url":"https://attack.mitre.org/detectionstrategies/DET0223#AN0625","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0038","component":"Application Log Content","name":"macos:jamf","channel":"RemoteCommandExecution","platforms":["macOS"],"analytic_id":"AN0625","source_url":"https://attack.mitre.org/detectionstrategies/DET0223#AN0625","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"}]},{"id":"AN0626","name":"Analytic 0626","guidance":"Detects cloud-native software deployment or management (e.g., SSM Run Command, Intune) initiating script execution on endpoints outside expected org IDs, admin groups, or maintenance windows.","url":"https://attack.mitre.org/detectionstrategies/DET0223#AN0626","platforms":["SaaS"],"tuning":[{"field":"IAMRoleAllowList","description":"Approved deployment administrators or service accounts"},{"field":"ExecutionTargetList","description":"Expected endpoints targeted by SaaS deployments"}],"log_sources":[{"component_id":"DC0064","component":"Command Execution","name":"AWS:CloudTrail","channel":"SSM RunCommand","platforms":["SaaS"],"analytic_id":"AN0626","source_url":"https://attack.mitre.org/detectionstrategies/DET0223#AN0626","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"}]},{"id":"AN0627","name":"Analytic 0627","guidance":"Detects central router or switch config management tools (e.g., FortiManager, Cisco Prime) triggering device reboots or config pushes using abnormal accounts or IPs.","url":"https://attack.mitre.org/detectionstrategies/DET0223#AN0627","platforms":["Network Devices"],"tuning":[{"field":"PushSourceAllowList","description":"Devices or IPs allowed to push firmware or scripts"},{"field":"AuthUserPattern","description":"Expected CLI or API user performing configuration"}],"log_sources":[{"component_id":"DC0038","component":"Application Log Content","name":"networkdevice:syslog","channel":"config push events","platforms":["Network Devices"],"analytic_id":"AN0627","source_url":"https://attack.mitre.org/detectionstrategies/DET0223#AN0627","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"},{"component_id":"DC0078","component":"Network Traffic Flow","name":"NSM:Flow","channel":"Device-to-Device Deployment Flows","platforms":["Network Devices"],"analytic_id":"AN0627","source_url":"https://attack.mitre.org/detectionstrategies/DET0223#AN0627","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0078/"}]}]}],"telemetry_references":[{"id":"DC0038","name":"Application Log Content","tag":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component"},{"id":"DC0064","name":"Command Execution","tag":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component"},{"id":"DC0078","name":"Network Traffic Flow","tag":"Network Traffic Flow","page":"telemetry/DC0078/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[{"id":"S0041","name":"Wiper","url":"https://attack.mitre.org/software/S0041","kind":"malware","description":"It is believed that a patch management system for an anti-virus product commonly installed among targeted companies was used to distribute the [Wiper](https://attack.mitre.org/software/S0041) malware.(Citation: Dell Wiper)","relationship_id":"relationship--82268341-e0a8-4937-8618-351e147daa0c","references":[{"source_name":"Dell Wiper","description":"Dell SecureWorks. (2013, March 21). Wiper Malware Analysis Attacking Korean Financial Sector. Retrieved May 13, 2015.","url":"http://www.secureworks.com/cyber-threat-intelligence/threats/wiper-malware-analysis-attacking-korean-financial-sector/"}]}],"actors":[{"id":"G0028","name":"Threat Group-1314","url":"https://attack.mitre.org/groups/G0028","kind":"intrusion-set","description":"[Threat Group-1314](https://attack.mitre.org/groups/G0028) actors used a victim's endpoint management platform, Altiris, for lateral movement.(Citation: Dell TG-1314)","relationship_id":"relationship--b38cfcfd-b8e3-4a9c-ade9-8a8bfeb04694","references":[{"source_name":"Dell TG-1314","description":"Dell SecureWorks Counter Threat Unit Special Operations Team. (2015, May 28). Living off the Land. Retrieved January 26, 2016.","url":"https://web.archive.org/web/20150626073312/http://www.secureworks.com/resources/blog/living-off-the-land/"}]},{"id":"G0034","name":"Sandworm Team","url":"https://attack.mitre.org/groups/G0034","kind":"intrusion-set","description":"[Sandworm Team](https://attack.mitre.org/groups/G0034) has used the commercially available tool RemoteExec for agentless remote code execution.(Citation: Microsoft Prestige ransomware October 2022)","relationship_id":"relationship--3fdd32ab-646e-4ba4-96fd-165a09db0c67","references":[{"source_name":"Microsoft Prestige ransomware October 2022","description":"MSTIC. (2022, October 14). New “Prestige” ransomware impacts organizations in Ukraine and Poland. Retrieved January 19, 2023.","url":"https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/"}]},{"id":"G0050","name":"APT32","url":"https://attack.mitre.org/groups/G0050","kind":"intrusion-set","description":"[APT32](https://attack.mitre.org/groups/G0050) compromised McAfee ePO to move laterally by distributing malware as a software deployment task.(Citation: FireEye APT32 May 2017)","relationship_id":"relationship--1d3654f8-3a5e-4ef8-826f-4242ecf78c0a","references":[{"source_name":"FireEye APT32 May 2017","description":"Carr, N.. (2017, May 14). Cyber Espionage is Alive and Well: APT32 and the Threat to Global Corporations. Retrieved June 18, 2017.","url":"https://www.fireeye.com/blog/threat-research/2017/05/cyber-espionage-apt32.html"}]},{"id":"G0091","name":"Silence","url":"https://attack.mitre.org/groups/G0091","kind":"intrusion-set","description":"[Silence](https://attack.mitre.org/groups/G0091) has used RAdmin, a remote software tool used to remotely control workstations and ATMs.(Citation: Group IB Silence Sept 2018)","relationship_id":"relationship--6fc128ed-90f3-4933-8ad7-4fd4a04cb39f","references":[{"source_name":"Group IB Silence Sept 2018","description":"Group-IB. (2018, September). Silence: Moving Into the Darkside. Retrieved May 5, 2020.","url":"https://go.group-ib.com/report-silence-en?_gl=1*d1bh3a*_ga*MTIwMzM5Mzc5MS4xNjk4OTI5NzY4*_ga_QMES53K3Y2*MTcwNDcyMjU2OS40LjEuMTcwNDcyMzU1Mi41My4wLjA."}]},{"id":"G0129","name":"Mustang Panda","url":"https://attack.mitre.org/groups/G0129","kind":"intrusion-set","description":"[Mustang Panda](https://attack.mitre.org/groups/G0129) has leveraged legitimate software tools such as AntiVirus Agents, Security Services, and App Development tools to execute scripts and to side-load dlls.(Citation: Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023)(Citation: Trend Micro Mustang Panda Earth Preta Toneshell February 2025)","relationship_id":"relationship--58aa294e-c14c-45f8-80e6-9b05229cbb0f","references":[{"source_name":"Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023","description":"Lior Rochberger, Tom Fakterman, Robert Falcone. (2023, September 22). Cyberespionage Attacks Against Southeast Asian Government Linked to Stately Taurus, Aka Mustang Panda. Retrieved September 9, 2025.","url":"https://unit42.paloaltonetworks.com/stately-taurus-attacks-se-asian-government/"},{"source_name":"Trend Micro Mustang Panda Earth Preta Toneshell February 2025","description":"Nathaniel Morales, Nick Dai. (2025, February 18). Earth Preta Mixes Legitimate and Malicious Components to Sidestep Detection. Retrieved September 10, 2025.","url":"https://www.trendmicro.com/en_us/research/25/b/earth-preta-mixes-legitimate-and-malicious-components-to-sidestep-detection.html"}]},{"id":"G1045","name":"Salt Typhoon","url":"https://attack.mitre.org/groups/G1045","kind":"intrusion-set","description":"[Salt Typhoon](https://attack.mitre.org/groups/G1045) has abused network management tools to include RANCID to facilitate actions in victims’ environments.(Citation: CISA_AA25-239ASaltTyphoon_Sept2025) ","relationship_id":"relationship--9a8dbb5c-c590-41ea-9404-0c78d6ae2d2a","references":[{"source_name":"CISA_AA25-239ASaltTyphoon_Sept2025","description":"CISA. (2025, September 3). Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System. Retrieved September 22, 2026.","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a"}]},{"id":"G1051","name":"Medusa Group","url":"https://attack.mitre.org/groups/G1051","kind":"intrusion-set","description":"[Medusa Group](https://attack.mitre.org/groups/G1051) has utilized software deployment and management solutions to deploy their encryption payload to include BigFix and PDQ Deploy.(Citation: CISA Medusa Group Medusa Ransomware March 2025)","relationship_id":"relationship--f5c91894-57ae-4e16-945f-8ad04f9c2d85","references":[{"source_name":"CISA Medusa Group Medusa Ransomware March 2025","description":"Cybersecurity and Infrastructure Security Agency. (2025, March 12). AA25-071A #StopRansomware: Medusa Ransomware. Retrieved October 15, 2025.","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a"}]},{"id":"G1055","name":"VOID MANTICORE","url":"https://attack.mitre.org/groups/G1055","kind":"intrusion-set","description":"[VOID MANTICORE](https://attack.mitre.org/groups/G1055) has leveraged legitimate built-in features of cloud-based management platforms to include mobile device management (MDM) and Remote Monitoring and Management (RMM) solutions.(Citation: SPECOPS Outpost24 Handala Hack Stryker March 2026)(Citation: Palo Alto VOID MANTICORE Iran Cyber Threats March 2026) [VOID MANTICORE](https://attack.mitre.org/groups/G1055) has also initiated built-in remote wipe instructions using a privileged account within Microsoft Intune.(Citation: SPECOPS Outpost24 Handala Hack Stryker March 2026)(Citation: Palo Alto VOID MANTICORE Iran Cyber Threats March 2026)","relationship_id":"relationship--692d7e4a-1208-4626-9bd2-209bc6b2d4f5","references":[{"source_name":"SPECOPS Outpost24 Handala Hack Stryker March 2026","description":"David Ketler. (2026, March 30). Stryker Cyber-Attack: What we Know so Far About the Remote Wipe Attack. Retrieved April 20, 2026.","url":"https://specopssoft.com/blog/stryker-cyber-attack-what-we-know-remote-wipe/"},{"source_name":"Palo Alto VOID MANTICORE Iran Cyber Threats March 2026","description":"Justin Moore. (2026, March 16). Iranian Cyber Threat Evolution: From MBR Wipers to Identity Weaponization. Retrieved April 20, 2026.","url":"https://unit42.paloaltonetworks.com/evolution-of-iran-cyber-threats/"}]},{"id":"G1057","name":"ShinyHunters","url":"https://attack.mitre.org/groups/G1057","kind":"intrusion-set","description":"[ShinyHunters](https://attack.mitre.org/groups/G1057) has abused software deployment tools for lateral movement.(Citation: SOCRadar_ShinyHunters_Mar2024)  ","relationship_id":"relationship--c331ae1d-c490-4366-9b39-e2b68073e606","references":[{"source_name":"SOCRadar_ShinyHunters_Mar2024","description":"SOCRadar. (2024, March 18). Dark Web Profile: ShinyHunters. Retrieved May 18, 2026.","url":"https://socradar.io/dark-web-profile-shinyhunters/"}]},{"id":"G1059","name":"NIMBUS MANTICORE","url":"https://attack.mitre.org/groups/G1059","kind":"intrusion-set","description":"[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has utilized commercial remote access tools such as Atelier Web Remote Commander (AWRC) and Microsoft System Center Configuration Manager (SCCM) within victim environments.(Citation: Mandiant_UNC1549TTPsTools_Nov2025)      ","relationship_id":"relationship--af3b443b-36e3-4b72-ad8a-1b84f214b282","references":[{"source_name":"Mandiant_UNC1549TTPsTools_Nov2025","description":"El-Banna, M., et al. (2025, November 17). Frontline Intelligence: Analysis of UNC1549 TTPs, Custom Tools, and Malware Targeting the Aerospace and Defense Ecosystem. Retrieved September 28, 2026.","url":"https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense"}]}],"mitigations":[{"id":"M1015","name":"Active Directory Configuration","url":"https://attack.mitre.org/mitigations/M1015","kind":"course-of-action","description":"Ensure proper system and access isolation for critical network systems through use of group policy.","relationship_id":"relationship--147b8bb5-ca4e-455e-a5b9-f0ab118c67eb","references":[]},{"id":"M1017","name":"User Training","url":"https://attack.mitre.org/mitigations/M1017","kind":"course-of-action","description":"Have a strict approval policy for use of deployment systems.","relationship_id":"relationship--8f4b9d5d-6ad7-4cca-9869-551604450f91","references":[]},{"id":"M1018","name":"User Account Management","url":"https://attack.mitre.org/mitigations/M1018","kind":"course-of-action","description":"Ensure that any accounts used by third-party providers to access these systems are traceable to the third-party and are not used throughout the network or used by other third-party providers in the same environment. Ensure there are regular reviews of accounts provisioned to these systems to verify continued business need, and ensure there is governance to trace de-provisioning of access that is no longer required. Ensure proper system and access isolation for critical network systems through use of account privilege separation.","relationship_id":"relationship--0dfd9bcd-f9e2-44c1-9d87-07c626644561","references":[]},{"id":"M1026","name":"Privileged Account Management","url":"https://attack.mitre.org/mitigations/M1026","kind":"course-of-action","description":"Grant access to application deployment systems only to a limited number of authorized administrators.","relationship_id":"relationship--43eebb80-4b8a-4690-a7e3-5f6f8e08db9f","references":[]},{"id":"M1027","name":"Password Policies","url":"https://attack.mitre.org/mitigations/M1027","kind":"course-of-action","description":"Verify that account credentials that may be used to access deployment systems are unique and not used throughout the enterprise network.","relationship_id":"relationship--7a20546a-c6be-4c1b-8b41-23cfb551f933","references":[]},{"id":"M1029","name":"Remote Data Storage","url":"https://attack.mitre.org/mitigations/M1029","kind":"course-of-action","description":"If the application deployment system can be configured to deploy only signed binaries, then ensure that the trusted signing certificates are not co-located with the application deployment system and are instead located on a system that cannot be accessed remotely or to which remote access is tightly controlled.","relationship_id":"relationship--e4236234-0fd7-426f-b55a-d32364e3a64e","references":[]},{"id":"M1030","name":"Network Segmentation","url":"https://attack.mitre.org/mitigations/M1030","kind":"course-of-action","description":"Ensure proper system isolation for critical network systems through use of firewalls.","relationship_id":"relationship--8eaad388-b7ef-4fb8-88e6-c6f36065c8c4","references":[]},{"id":"M1032","name":"Multi-factor Authentication","url":"https://attack.mitre.org/mitigations/M1032","kind":"course-of-action","description":"Ensure proper system and access isolation for critical network systems through use of multi-factor authentication.","relationship_id":"relationship--c869db21-9c91-4449-b316-408bcab56e1b","references":[]},{"id":"M1033","name":"Limit Software Installation","url":"https://attack.mitre.org/mitigations/M1033","kind":"course-of-action","description":"Restrict the use of third-party software suites installed within an enterprise network. ","relationship_id":"relationship--87cf80be-bae1-4a12-a754-38cad36724ac","references":[]},{"id":"M1051","name":"Update Software","url":"https://attack.mitre.org/mitigations/M1051","kind":"course-of-action","description":"Patch deployment systems regularly to prevent potential remote access through [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068).","relationship_id":"relationship--33a54656-6370-4c22-af67-4ff528ba1568","references":[]}],"candidates":[{"id":"2169e8b0-2ee7-44cb-8a6e-d816a5db7d8a","name":"Deploy 7-Zip Using Chocolatey","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1072/T1072.yaml","description":"An adversary may use Chocolatey to remotely deploy the 7-Zip file archiver utility.\n","inputs":{},"dependencies":[{"description":"Chocolatey must be installed to deploy 7-Zip.\n"}],"source_definition_sha256":"6feeda57d648c988abc2f86f04037d2048b3ea0719c4d67454eab2c3654f0634"},{"id":"b4988cad-6ed2-434d-ace5-ea2670782129","name":"Radmin Viewer Utility","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1072/T1072.yaml","description":"An adversary may use Radmin Viewer Utility to remotely control Windows device, this will start the radmin console.\n","inputs":{"radmin_installer":{"description":"Radmin Viewer installer","type":"path","default":"RadminViewer.msi"},"radmin_exe":{"description":"The radmin.exe executable from RadminViewer.msi","type":"path","default":"Radmin Viewer 3/Radmin.exe"}},"dependencies":[{"description":"Radmin Viewer Utility must be installed at specified location (#{radmin_exe})\n"}],"source_definition_sha256":"998bae7e83697114bc73eb09bfdf18fceefad496ed3aa9e29e598079f82b944c"},{"id":"e447b83b-a698-4feb-bed1-a7aaf45c3443","name":"PDQ Deploy RAT","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1072/T1072.yaml","description":"An adversary may use PDQ Deploy Software to deploy the Remote Adminstartion Tool, this will start the PDQ console.\n","inputs":{"PDQ_Deploy_installer":{"description":"PDQ Deploy Install","type":"path","default":"PDQDeploysetup.exe"},"PDQ_Deploy_exe":{"description":"The PDQDeployConsole.exe executable from PDQDeploysetup.exe","type":"path","default":"Admin Arsenal/PDQ Deploy/PDQDeployConsole.exe"}},"dependencies":[{"description":"PDQ Deploy will be installed at specified location (#{PDQ_Deploy_exe})\n"}],"source_definition_sha256":"00e5eca71260b6efd4a96b55c719748460e8eeee6b627b5d53d61fac2727d495"}],"simulation":{"atomic_status":"documented_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1651":"/ttp-simulation/techniques/enterprise/T1651/","T1071.001":"/ttp-simulation/techniques/enterprise/T1071.001/","T1072":"/ttp-simulation/techniques/enterprise/T1072/","T1068":"/ttp-simulation/techniques/enterprise/T1068/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1072","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0078","collector":"illustrative-lab-collector","observation":{"source_ip":"192.0.2.10","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","bytes_sent":128,"bytes_received":512}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}}]}}