.. / Msdeploy.exe
Star

Microsoft tool used to deploy Web Applications.


Paths:


Resources:
https://twitter.com/pabraeken/status/995837734379032576
https://twitter.com/pabraeken/status/999090532839313408

Acknowledgement:
Pierre-Alexandre Braeken - @pabraeken


Detection:



Execute

Launch calc.bat via msdeploy.exe.
msdeploy.exe -verb:sync -source:RunCommand -dest:runCommand="c:\temp\calc.bat"
Usecase:Local execution of batch file using msdeploy.exe.
Privileges required:User
OS:Windows server
Mitre:T1218



AWL bypass

Launch calc.bat via msdeploy.exe.
msdeploy.exe -verb:sync -source:RunCommand -dest:runCommand="c:\temp\calc.bat"
Usecase:Local execution of batch file using msdeploy.exe.
Privileges required:User
OS:Windows server
Mitre:T1218