Software Deployment Tools

An adversary with deployment-capable access to a centralized endpoint-management or configuration-management plane can use its native application, script, or remote-task features to execute commands or deploy software to managed systems, enabling execution and lateral movement. Examples include Microsoft Configuration Manager, Microsoft Intune, and Ansible. Required roles, target scopes, and endpoint connectivity vary by platform. A cloud management service such as Intune can support this procedure through its Internet-facing service without an internal-network foothold when the actor has the required tenant permissions and the endpoints are enrolled and communicating; on-premises variants may require internal access. This technique does not by itself establish initial access or persistence.