[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:mitre-attack\u002Ft1072":3},{"item":4,"lessons":18,"controls":40,"related":68},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"mitre-attack","t1072","T1072","Software Deployment Tools",5,"MITRE","**What attackers do.** Attackers use centralised software deployment and management tools, such as endpoint management or patch systems, to run commands or install malware across many systems at once. This serves Execution and Lateral Movement.\n\n**How to defend.** Treat deployment platforms as tier zero, restrict and monitor administrative access with MFA, and require approval for new deployments. Log all deployment activity and review it against change records. Separate deployment administration accounts from everyday accounts and limit the scope each administrator can push to. Alert when deployment tool credentials are used from unusual hosts.\n\n**Signs to look for.** Look for deployments outside change windows, new packages or scripts created by unusual accounts and simultaneous execution of the same command across many hosts. A common gap is that deployment tool activity is trusted and not monitored by security.","Adversaries may gain access to and use centralized software suites installed within an enterprise to execute commands and move laterally through the network. Configuration management and software deployment applications may be used in an enterprise network or cloud environment for routine administration purposes. These systems may also be integrated into CI\u002FCD pipelines. Examples of such solutions include: SCCM, HBSS, Altiris, AWS Systems Manager, Microsoft Intune, Azure Arc, and GCP Deployment Manager.  \n\nAccess to network-wide or enterprise-wide endpoint management software may enable an adversary to achieve remote code execution on all connected systems. The access may be used to laterally move to other systems, gather information, or cause a specific effect, such as wiping the hard drives on all endpoints.\n\nSaaS-based configuration management services may allow for broad Cloud Administration Command on cloud-hosted instances, as well as the execution of arbitrary commands on on-premises endpoints. For example, Microsoft Configuration Manager allows Global or Intune Administrators to run scripts as SYSTEM on on-premises devices joined to Entra ID. Such services may also utilize Web Protocols to communicate back to adversary owned infrastructure.","© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).","https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1072\u002F","Open the technique on MITRE ATT&CK",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36],{"slug":21,"title":22,"published_at":23},"critical-rce-flaw-in-n-central-rmm-demands-urgent-patching","Critical RCE Flaw in N-central RMM Demands Urgent Patching","2026-09-07T10:20:25.834+00:00",{"slug":25,"title":26,"published_at":27},"hijacked-screenconnect-instances-spread-worm-like-malware-across-networks","Hijacked ScreenConnect Instances Spread Worm-Like Malware Across Networks","2026-09-03T19:20:59.39+00:00",{"slug":29,"title":30,"published_at":31},"attackers-hijack-legitimate-it-admin-tool-to-deploy-stealthy-remote-access","Attackers Hijack Legitimate IT Admin Tool to Deploy Stealthy Remote Access","2026-09-01T22:21:17.886+00:00",{"slug":33,"title":34,"published_at":35},"malware-exploits-trusted-ai-tools-to-blend-in-and-evade-detection","Malware Exploits Trusted AI Tools to Blend In and Evade Detection","2026-07-22T22:20:33.815+00:00",{"slug":37,"title":38,"published_at":39},"iranian-hackers-exploit-sysaid-updates-and-it-providers-to-infiltrate-israeli-targets","Iranian Hackers Exploit SysAid Updates and IT Providers to Infiltrate Israeli Targets","2026-07-06T20:20:43.982+00:00",[41,46,51,55,59,64],{"slug":42,"name":43,"problem":44,"stories":45},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",4,{"slug":47,"name":48,"problem":49,"stories":50},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",2,{"slug":52,"name":53,"problem":54,"stories":50},"patch-management","Automated patch management","Known holes get closed in days, not months.",{"slug":56,"name":57,"problem":58,"stories":50},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",{"slug":60,"name":61,"problem":62,"stories":63},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",1,{"slug":65,"name":66,"problem":67,"stories":63},"firewall","Next-generation firewall and intrusion prevention","Malicious traffic is blocked at the network edge and between zones.",[69,74,78,84,88,92,96,100],{"family":70,"item":71,"code":72,"title":73,"together":45},"cis","2","Control 2","Inventory and Control of Software Assets",{"family":70,"item":75,"code":76,"title":77,"together":45},"13","Control 13","Network Monitoring and Defense",{"family":79,"item":80,"code":81,"title":82,"together":83},"nist-800-53","ac-17","AC-17","Remote Access",3,{"family":85,"item":86,"code":87,"title":87,"together":83},"itil","overview","ITIL",{"family":70,"item":89,"code":90,"title":91,"together":83},"12","Control 12","Network Infrastructure Management",{"family":70,"item":93,"code":94,"title":95,"together":50},"7","Control 7","Continuous Vulnerability Management",{"family":5,"item":97,"code":98,"title":99,"together":50},"t1210","T1210","Exploitation of Remote Services",{"family":79,"item":101,"code":102,"title":103,"together":50},"cm-7","CM-7","Least Functionality"]