MITRE ATT&CKtechnique

T1072 Software Deployment Tools

Published 2017-05-31 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Execution, Lateral Movement
Platforms
Linux, macOS, Network Devices, SaaS, Windows
Version
3.2
Created
2017-05-31

Description

Adversaries may gain access to and use centralized software suites installed within an enterprise to execute commands and move laterally through the network. Configuration management and software deployment applications may be used in an enterprise network or cloud environment for routine administration purposes. These systems may also be integrated into CI/CD pipelines. Examples of such solutions include: SCCM, HBSS, Altiris, AWS Systems Manager, Microsoft Intune, Azure Arc, and GCP Deployment Manager. Access to network-wide or enterprise-wide endpoint management software may enable an adversary to achieve remote code execution on all connected systems. The access may be used to laterally move to other systems, gather information, or cause a specific effect, such as wiping the hard drives on all endpoints. SaaS-based configuration management services may allow for broad Cloud Administration Command on cloud-hosted instances, as well as the execution of arbitrary commands on on-premises endpoints. For example, Microsoft Configuration Manager allows Global or Intune Administrators to run scripts as SYSTEM on on-premises devices joined to Entra ID. Such services may also utilize Web Protocols to communicate back to adversary owned infrastructure. Network infrastructure devices may also have configuration management tools that can be similarly abused by adversaries. The permissions required for this action vary by system configuration; local credentials may be sufficient with direct access to the third-party system, or specific domain credentials may be required. However, the system may require an administrative account to log in or to access specific functionality.

Related

Tactic · MITRE ATT&CK (2)

Referenced by MITRE ATT&CK · mitigates (10)

  • M1033 Limit Software Installation mitigation
  • M1051 Update Software mitigation
  • M1030 Network Segmentation mitigation
  • M1032 Multi-factor Authentication mitigation
  • M1015 Active Directory Configuration mitigation
  • M1017 User Training mitigation
  • M1018 User Account Management mitigation
  • M1026 Privileged Account Management mitigation
  • M1027 Password Policies mitigation
  • M1029 Remote Data Storage mitigation

Referenced by MITRE ATT&CK · uses (12)

Referenced by CAPEC · att&ck technique (2)

  • CAPEC-187 Malicious Automated Software Update via Redirection attack pattern
  • CAPEC-657 Malicious Automated Software Update via Spoofing attack pattern

Referenced by Compliance · mitigates (37)

  • CIS-12.2 Establish and Maintain a Secure Network Architecture CIS Safeguard v8.1
  • CIS-15.7 Securely Decommission Service Providers CIS Safeguard v8.1
  • CIS-16.8 Separate Production and Non-Production Systems CIS Safeguard v8.1
  • CIS-4.6 Securely Manage Enterprise Assets and Software CIS Safeguard v8.1
  • CIS-4.8 Uninstall or Disable Unnecessary Services on Enterprise Assets and Software CIS Safeguard v8.1
  • CIS-6.5 Require MFA for Administrative Access CIS Safeguard v8.1
  • CIS-6.8 Define and Maintain Role-Based Access Control CIS Safeguard v8.1
  • CIS-7.3 Perform Automated Operating System Patch Management CIS Safeguard v8.1
  • CIS-7.4 Perform Automated Application Patch Management CIS Safeguard v8.1
  • CIS-7.7 Remediate Detected Vulnerabilities CIS Safeguard v8.1
  • NIST-AC-12 Session Termination NIST 800-53 control
  • NIST-AC-2 Account Management NIST 800-53 control
  • NIST-AC-20 Use of External Systems NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-4 Information Flow Enforcement NIST 800-53 control
  • NIST-AC-5 Separation of Duties NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-CA-7 Continuous Monitoring NIST 800-53 control
  • NIST-CM-11 User-installed Software NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-5 Access Restrictions for Change NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-CM-7 Least Functionality NIST 800-53 control
  • NIST-CM-8 System Component Inventory NIST 800-53 control
  • NIST-IA-2 Identification and Authentication (Organizational Users) NIST 800-53 control
  • NIST-IA-5 Authenticator Management NIST 800-53 control
  • NIST-SA-10 Developer Configuration Management NIST 800-53 control
  • NIST-SA-9 External System Services NIST 800-53 control
  • NIST-SC-12 Cryptographic Key Establishment and Management NIST 800-53 control
  • NIST-SC-17 Public Key Infrastructure Certificates NIST 800-53 control
Show all 37 ›

References