1200KM / sigma-rule
Execute Files with Msdeploy.exe — Sigma Rule
Sigma rule 646bc99f-6682-4b47-a73a-17b1b64c9d34. Execute Files with Msdeploy.exe — Sigma Rule. Detects file execution using the msdeploy.exe lolbin
Rule metadata and linked tags
Author: Beyu Denis, oscd.community. Source status: test; severity: medium. Source dates: 2020-10-18 / 2021-11-27.
{
"category": "process_creation",
"product": "windows"
}Pinned original Sigma rule · Detection Rule License 1.1
Source SHA-256: 9d5eb1c57f8bdafeb657c3f712c8d76b7422fe3e5f1431bada5ce073fc16ad7d
Detection logic
Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.
title: Execute Files with Msdeploy.exe
id: 646bc99f-6682-4b47-a73a-17b1b64c9d34
status: test
description: Detects file execution using the msdeploy.exe lolbin
references:
- https://lolbas-project.github.io/lolbas/OtherMSBinaries/Msdeploy/
- https://twitter.com/pabraeken/status/995837734379032576
- https://twitter.com/pabraeken/status/999090532839313408
author: Beyu Denis, oscd.community
date: 2020-10-18
modified: 2021-11-27
tags:
- attack.stealth
- attack.t1218
logsource:
category: process_creation
product: windows
detection:
selection:
CommandLine|contains|all:
- 'verb:sync'
- '-source:RunCommand'
- '-dest:runCommand'
Image|endswith: '\msdeploy.exe'
condition: selection
falsepositives:
- System administrator Usage
level: medium
False positives
- System administrator Usage
Source references
Connected ecosystem references
Exact source-tagged techniques
Telemetry review
Read the original logsource above, then inspect the linked detection workspaces for technique-level sensor context. No per-rule telemetry equivalence is inferred.
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.