T1072ExecutionLateral Movement
Software Deployment Tools
Adversaries may gain access to and use centralized software suites installed within an enterprise to execute commands and move laterally through the network. Configuration management and software deployment applications may be used in an enterprise network or cloud environment for routine administration purposes. These systems may also be integrated into CI/CD pipelines. Examples of such…
CVEs1
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.1
Reports2
Detections
4 Sigma rules tagged T1072Software Deployment ToolsT10724 general rules
- Restricted Software Access By SRPhightest
- PDQ Deploy Remote Adminstartion Tool Executionmediumtest
- PUA - Radmin Viewer Utility Executionmediumtest
- Suspicious Csi.exe Usagemediumtest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Software Deployment Tools
1 CVE, by priority. Each link shows its badge.- CVE-2022-40139Trend Micro Apex One and Apex One as a Service Improper Validation VulnerabilityTrend Micro · Apex One and Apex One as a ServiceKEVHigh · 7.2T1078Valid AccountsT1059Command and Scripting Interpreter+1 moreAI mapping from the description · primary impact3.4%Top 11%60.8priority
Passages that support these links
RoyalRoad leverages a specific set of vulnerabilities, including CVE-2018-0802, CVE-2018-0798, and CVE-2017-11882, within the Equation Editor of Microsoft Office.
RoyalRoad leverages a specific set of vulnerabilities, including CVE-2018-0802, CVE-2018-0798, and CVE-2017-11882, within the Equation Editor of Microsoft Office.
RoyalRoad leverages a specific set of vulnerabilities, including CVE-2018-0802, CVE-2018-0798, and CVE-2017-11882, within the Equation Editor of Microsoft Office.