Execute Files with Msdeploy.exe

Title: Execute Files with Msdeploy.exe
Status: test
Description:Detects file execution using the msdeploy.exe lolbin
References:
  -https://lolbas-project.github.io/lolbas/OtherMSBinaries/Msdeploy/
  -https://twitter.com/pabraeken/status/995837734379032576
  -https://twitter.com/pabraeken/status/999090532839313408
Author: Beyu Denis, oscd.community
Date: 2020-10-18
modified:2021-11-27
Tags:

• -'attack.stealth'
• -'attack.t1218'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    CommandLine|contains|all:
      -'verb:sync'
      -'-source:RunCommand'
      -'-dest:runCommand'

    Image|endswith: '\msdeploy.exe'
  condition:selection
Falsepositives:
  -System administrator Usage
Level: medium