Software deployment agent spawning a script interpreter

1title: Software deployment agent spawning a script interpreter2id: a59e0d54-76dc-46ac-90de-4fc3f2d2055f3status: experimental4description: |5  Anchors on the parent rather than the payload: AN0623 describes push6  execution arriving through an endpoint-management suite, so the observable is7  the deployment agent itself appearing as the parent of a shell or scripting8  host. The first leg pairs a management-agent parent with an interpreter9  child; the second leg needs no child gate at all, because `cmtrace.exe` is a10  log viewer with a menu entry that launches arbitrary programs, and it has no11  routine reason to be anyone's parent process. MITRE names the12  `ParentImageList` knob and names cmtrace.exe as its example; the rest of the13  parent list is authored here — CcmExec.exe is the Configuration Manager14  client service, and Microsoft.Management.Services.IntuneWindowsAgent.exe with15  AgentExecutor.exe are the pair that runs assigned scripts on an Intune-managed16  host. Note the Intune binary name: the *service* is named17  IntuneManagementExtension and the install folder is "Microsoft Intune18  Management Extension", but no `IntuneManagementExtension.exe` exists on disk,19  so matching that name yields a selector that can never fire. The brief20  offers Security EventID 4688 for this analytic but maps it onto the21  Sysmon-shaped `process_creation` category, and the rule is written in that22  vocabulary (`Image`, `ParentImage`); a 4688 feed needs `NewProcessName`23  mapped onto `Image` and `ParentProcessName` onto `ParentImage` before it can24  match, and 4688 itself requires *Audit Process Creation*, which no default25  install and neither the MS nor the CIS baseline enables. Two limits worth26  stating: agents for other suites — Ansible or Chef over WinRM, AWS Systems27  Manager, Azure Arc, Tanium, Altiris — spawn under worker-process names that28  differ by product and version and are not in the list, so a quiet result29  means the site's tool is unlisted rather than that no push execution30  happened; and remote execution driven over WinRM or WMI parents under31  wsmprovhost.exe or WmiPrvSE.exe, which is T1021.006 and T1047 and is out of32  scope here. MITRE's `TimeWindow` and `UserContext` knobs ask for "outside the33  maintenance window" and "not the expected service account", both of which are34  comparisons against a baseline that a single-event rule cannot make.35  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0223, not hand-written and not tested by its author. Any lab result is on this rule's own page.36references:37  - https://attack.mitre.org/techniques/T107238  - https://attack.mitre.org/detectionstrategies/DET022339author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)40date: 2026-08-1641tags:42  - attack.execution43  - attack.lateral-movement44  - attack.t107245logsource:46  category: process_creation47  product: windows48detection:49  selection_agent:50    ParentImage|endswith:51      - '\CcmExec.exe'52      - '\Microsoft.Management.Services.IntuneWindowsAgent.exe'53      - '\AgentExecutor.exe'54  selection_interpreter:55    Image|endswith:56      - '\powershell.exe'57      - '\pwsh.exe'58      - '\cmd.exe'59      - '\wscript.exe'60      - '\cscript.exe'61      - '\mshta.exe'62      - '\rundll32.exe'63      - '\regsvr32.exe'64  selection_cmtrace:65    ParentImage|endswith: '\cmtrace.exe'66  condition: (selection_agent and selection_interpreter) or selection_cmtrace67falsepositives:68  - "Every sanctioned deployment on a managed fleet, because running scripts and installers as SYSTEM is precisely what these agents are for — application installs, script assignments, compliance remediations and detection scripts all match the agent leg, making it the highest-volume match by a wide margin and the reason this is rated low rather than treated as an alert on its own."69  - "Scheduled patch and compliance cycles firing the same PowerShell or cmd wrapper on every in-scope host within the same maintenance window, producing a fleet-wide burst that has the shape of coordinated remote execution and is simply the monthly cycle."70  - "An administrator reading deployment logs on a site server and using CMTrace's own menu to open a command prompt or launch a tool, which matches the cmtrace leg with no child gate to soften it."71  - "Application packagers who wrap an installer in cmd.exe /c or a PowerShell script so one deployment can chain a prerequisite check, the MSI call and a post-install cleanup — a common packaging convention that puts an interpreter directly under the agent by design."72level: low