Execute Files with Msdeploy.exe

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•15

This rule detects the execution of msdeploy.exe with specific command-line arguments that indicate an attempt to execute arbitrary commands. Adversaries may abuse msdeploy.exe, a legitimate Microsoft utility, to proxy execution of malicious content, bypassing security controls that monitor for direct execution of suspicious binaries. The rule specifically looks for the 'verb:sync', '-source:RunCommand', and '-dest:runCommand' arguments in conjunction with msdeploy.exe, which are indicative of this technique.