Windows msdeploy.exe Executes with Sync Verb and RunCommand Source/Destination

Flags msdeploy.exe executions that include sync verb plus RunCommand source and destination parameters.

FreeUnreviewedSigmamediumv1

windows-msdeploy-exe-executes-with-sync-verb-and-runcommand-source-destination-646bc99f

title: Windows msdeploy.exe Executes with Sync Verb and RunCommand Source/Destination
id: 0f3dafbb-fe9d-4883-b7fe-7b9a674f4c4c
status: test
description: This rule identifies execution of msdeploy.exe where the command line includes the sync verb and uses RunCommand for both source and destination. Attackers may use this built-in utility to perform stealthy file transfer or command execution workflows under a trusted process. The detection relies on Windows process creation telemetry, specifically matching msdeploy.exe in the process image path and required substrings in the command line.
references:
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Msdeploy/
  - https://twitter.com/pabraeken/status/995837734379032576
  - https://twitter.com/pabraeken/status/999090532839313408
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_lolbin_msdeploy.yml
author: Beyu Denis, oscd.community, Huntrule Team
date: 2020-10-18
modified: 2021-11-27
tags:
  - attack.stealth
  - attack.t1218
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains|all:
      - verb:sync
      - -source:RunCommand
      - -dest:runCommand
    Image|endswith: \msdeploy.exe
  condition: selection
falsepositives:
  - System administrator Usage
level: medium
license: DRL-1.1
related:
  - id: 646bc99f-6682-4b47-a73a-17b1b64c9d34
    type: derived

What it detects

This rule identifies execution of msdeploy.exe where the command line includes the sync verb and uses RunCommand for both source and destination. Attackers may use this built-in utility to perform stealthy file transfer or command execution workflows under a trusted process. The detection relies on Windows process creation telemetry, specifically matching msdeploy.exe in the process image path and required substrings in the command line.

Known false positives

System administrator Usage

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.