Unmasking SCCM Application Execution
Summary
This article details how executing applications through SCCM's 'deploy application' feature generates different artifacts than script-based execution. While current detection tools are effective against script execution, they often fail to identify more covert application execution methods. The post aims to provide methods for detecting these stealthier approaches.
IFF Assessment
The article describes a stealthier method for executing applications via SCCM, which could be exploited by adversaries to evade detection, posing a risk to defenders.
Defender Context
Defenders need to be aware of the distinct artifacts generated by application execution versus script execution within SCCM. Enhancing detection mechanisms to cover these application execution methods is crucial for identifying potential adversary activity that might otherwise go unnoticed.