Software deployment agent spawning a script interpreter

Siemphony@siemphonylowT1072unverified

Anchors on the parent rather than the payload: AN0623 describes push execution arriving through an endpoint-management suite, so the observable is the deployment agent itself appearing as the parent of a shell or scripting host. The first leg pairs a management-agent parent with an interpreter child; the second leg needs no child gate at all, because `cmtrace.exe` is a log viewer with a menu entry that launches arbitrary programs, and it has no routine reason to be anyone's parent process. MITRE names the `ParentImageList` knob and names cmtrace.exe as its example; the rest of the parent list is authored here — CcmExec.exe is the Configuration Manager client service, and Microsoft.Management.Services.IntuneWindowsAgent.exe with AgentExecutor.exe are the pair that runs assigned scripts on an Intune-managed host. Note the Intune binary name: the *service* is named IntuneManagementExtension and the install folder is "Microsoft Intune Management Extension", but no `IntuneManagementExtension.exe` exists on disk, so matching that name yields a selector that can never fire. The brief offers Security EventID 4688 for this analytic but maps it onto the Sysmon-shaped `process_creation` category, and the rule is written in that vocabulary (`Image`, `ParentImage`); a 4688 feed needs `NewProcessName` mapped onto `Image` and `ParentProcessName` onto `ParentImage` before it can match, and 4688 itself requires *Audit Process Creation*, which no default install and neither the MS nor the CIS baseline enables. Two limits worth stating: agents for other suites — Ansible or Chef over WinRM, AWS Systems Manager, Azure Arc, Tanium, Altiris — spawn under worker-process names that differ by product and version and are not in the list, so a quiet result means the site's tool is unlisted rather than that no push execution happened; and remote execution driven over WinRM or WMI parents under wsmprovhost.exe or WmiPrvSE.exe, which is T1021.006 and T1047 and is out of scope here. MITRE's `TimeWindow` and `UserContext` knobs ask for "outside the maintenance window" and "not the expected service account", both of which are comparisons against a baseline that a single-event rule cannot make. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0223, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (((InitiatingProcessFolderPath endswith "\\CcmExec.exe" or InitiatingProcessFolderPath endswith "\\Microsoft.Management.Services.IntuneWindowsAgent.exe" or InitiatingProcessFolderPath endswith "\\AgentExecutor.exe") and (FolderPath endswith "\\powershell.exe" or FolderPath endswith "\\pwsh.exe" or FolderPath endswith "\\cmd.exe" or FolderPath endswith "\\wscript.exe" or FolderPath endswith "\\cscript.exe" or FolderPath endswith "\\mshta.exe" or FolderPath endswith "\\rundll32.exe" or FolderPath endswith "\\regsvr32.exe")) or InitiatingProcessFolderPath endswith "\\cmtrace.exe")

Splunk · SPL

Run this as a search.

index=* (((ParentImage="*\\CcmExec.exe" OR ParentImage="*\\Microsoft.Management.Services.IntuneWindowsAgent.exe" OR ParentImage="*\\AgentExecutor.exe") AND (Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\cmd.exe" OR Image="*\\wscript.exe" OR Image="*\\cscript.exe" OR Image="*\\mshta.exe" OR Image="*\\rundll32.exe" OR Image="*\\regsvr32.exe")) OR ParentImage="*\\cmtrace.exe")

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (((TO_LOWER(process.parent.executable) LIKE "*\\\\ccmexec.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\microsoft.management.services.intunewindowsagent.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\agentexecutor.exe") AND (TO_LOWER(process.executable) LIKE "*\\\\powershell.exe" OR TO_LOWER(process.executable) LIKE "*\\\\pwsh.exe" OR TO_LOWER(process.executable) LIKE "*\\\\cmd.exe" OR TO_LOWER(process.executable) LIKE "*\\\\wscript.exe" OR TO_LOWER(process.executable) LIKE "*\\\\cscript.exe" OR TO_LOWER(process.executable) LIKE "*\\\\mshta.exe" OR TO_LOWER(process.executable) LIKE "*\\\\rundll32.exe" OR TO_LOWER(process.executable) LIKE "*\\\\regsvr32.exe")) OR TO_LOWER(process.parent.executable) LIKE "*\\\\cmtrace.exe")

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <!-- 2 rules: the Sigma condition ORs across different fields,       which one rule cannot express. Any one matching is a hit. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="ParentImage" type="pcre2">(?i)(\\CcmExec\.exe$|\\Microsoft\.Management\.Services\.IntuneWindowsAgent\.exe$|\\AgentExecutor\.exe$)</field>    <field name="Image" type="pcre2">(?i)(\\powershell\.exe$|\\pwsh\.exe$|\\cmd\.exe$|\\wscript\.exe$|\\cscript\.exe$|\\mshta\.exe$|\\rundll32\.exe$|\\regsvr32\.exe$)</field>    <description>Software deployment agent spawning a script interpreter (1/2)</description>    <mitre>      <id>T1072</id>    </mitre>  </rule>   <rule id="100001" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="ParentImage" type="pcre2">(?i)\\cmtrace\.exe$</field>    <description>Software deployment agent spawning a script interpreter (2/2)</description>    <mitre>      <id>T1072</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: low
Category: lateral_movement_remote_exec
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: a59e0d54-76dc-46ac-90de-4fc3f2d2055f

ATT&CKT1072

T1072Software Deployment Tools

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonlateral movement remote exec

lateral movement remote execAI draft — unreviewed

01 · What this rule detects

Push execution through an endpoint-management suite. MITRE's AN0623 describes SCCM, Intune or remote-push tooling spawning scripts or binaries from SYSTEM context, and names "cmtrace.exe launching PowerShell or cmd.exe" as its example. The rule takes the parent as the observable rather than the payload, because the payload is whatever the operator picked, while the parent is the part that says this ran because something off-box told it to.

02 · Telemetry you need

Windows process creation with the parent recorded. Sysmon EventID 1 gives Image and ParentImage directly. The brief also offers Security 4688, but that feed names the same things NewProcessName and ParentProcessName; the rule is written in the Sysmon vocabulary the process_creation category assumes, so a 4688 source needs those two fields mapped before it can match at all. 4688 additionally requires Audit Process Creation, which no default install and neither the MS nor the CIS baseline enables. No command line is inspected, so the separate command-line policy is not needed here.

03 · How the logic works

Three blocks, two legs. selection_agent matches ParentImage|endswith against \CcmExec.exe (the Configuration Manager client service) and the pair \Microsoft.Management.Services.IntuneWindowsAgent.exe and \AgentExecutor.exe, which run assigned scripts on an Intune-managed host. selection_interpreter matches Image|endswith against eight shells and script hosts: powershell, pwsh, cmd, wscript, cscript, mshta, rundll32, regsvr32. Those two are ANDed. selection_cmtrace stands alone with no child gate, because CMTrace is a log viewer whose menu launches arbitrary programs and it has no routine reason to be anyone's parent. The condition is (selection_agent and selection_interpreter) or selection_cmtrace. MITRE names the ParentImageList knob and offers CCMExec.exe as its example; the remaining parent names and the entire interpreter list are the pipeline's own. Note the Intune binary specifically — the service is called IntuneManagementExtension, but no IntuneManagementExtension.exe exists on disk, so matching that string would yield a selector that can never fire.

04 · Common false positives

Constantly, by design. Running installers and scripts as SYSTEM is the entire purpose of these agents, so every application install, script assignment, compliance remediation and detection script matches the agent leg. Packagers routinely wrap an MSI in cmd /c or a PowerShell script to chain a prerequisite check and a post-install cleanup, putting an interpreter directly under the agent as a convention. Patch cycles fire that wrapper across the whole fleet inside one window, producing a burst shaped exactly like coordinated remote execution. An administrator opening a command prompt from CMTrace's own menu hits the un-gated leg. That is why the level is low: the loudest false positive is the highest-volume match by a wide margin.

05 · Detection maturity

tier_1: Lowest tier, and it stays there until the rule has been run against real data. It was derived from a MITRE scaffold and has never been executed against a log line: no confirmed true positive, no measured false-positive rate, no volume estimate. Run it over a historical search window first, count what returns, and only then decide whether the parent list or the interpreter list is the half that needs work.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Baseline ParentImage plus Image pairs for a week and learn what your packaging convention normally produces — deviation from that shape is the signal, not the match itself. MITRE's UserContext knob (expected deployment from scheduled system accounts) and TimeWindow knob (outside standard maintenance hours) both need a baseline a single-event rule cannot hold; carry them in the SIEM as a scheduled comparison. Add your own suite's worker binary: Ansible over WinRM, Tanium, Altiris, AWS Systems Manager and Azure Arc all use names absent from this list, so silence means unlisted, not absent. WinRM and WMI parents (wsmprovhost.exe, WmiPrvSE.exe) are T1021.006 and T1047 and are deliberately out of scope.

Declared by the author

Every sanctioned deployment on a managed fleet, because running scripts and installers as SYSTEM is precisely what these agents are for — application installs, script assignments, compliance remediations and detection scripts all match the agent leg, making it the highest-volume match by a wide margin and the reason this is rated low rather than treated as an alert on its own.
Scheduled patch and compliance cycles firing the same PowerShell or cmd wrapper on every in-scope host within the same maintenance window, producing a fleet-wide burst that has the shape of coordinated remote execution and is simply the monthly cycle.
An administrator reading deployment logs on a site server and using CMTrace's own menu to open a command prompt or launch a tool, which matches the cmtrace leg with no child gate to soften it.
Application packagers who wrap an installer in cmd.exe /c or a PowerShell script so one deployment can chain a prerequisite check, the MSI call and a post-install cleanup — a common packaging convention that puts an interpreter directly under the agent by design.

Noise checkfires on 2 of 30

Fires on 2 of 30 ordinary behaviours the baseline holds for this log type. Each is something a managed estate does on purpose, so each is a false positive an analyst would have to close.

pc-sccm-powershell-bypass
ConfigMgr runs deployment scripts with ExecutionPolicy Bypass by design. This is the single most common benign trigger for PowerShell policy rules.
pc-intune-encodedcommand
Intune Management Extension executes remediation scripts as base64. Encoded PowerShell is routine on any Intune-managed estate.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
0 true · 2 false · 100.0% noise

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1072, evaluated against their process_creation events.

Share this rule

/u/siemphony/a59e0d54-76dc-46ac-90de-4fc3f2d2055f

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Software deployment agent spawning a script interpreter

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it