Abuse centralized enterprise software deployment or configuration-management systems to execute packages or scripts across managed endpoints, enabling lateral movement. This reviewed example covers a Microsoft Configuration Manager legacy package/program deployment; direct SMB share enumeration, SMBExec, and WinRM sessions are separate remote-service procedures and do not establish T1072.
Check before starting: RESTRICTED_ACCESS_BLUR_MARKER
Variant:
Full outcome coverage
MalSCCM · Create and Deploy Application
Create and Deploy Application
powershell
RESTRICTED_ACCESS_BLUR_MARKER
Version: RESTRICTED_ACCESS_BLUR_MARKER. Requirements: none specified (operational prerequisites may still apply)Documents all requested outcomes. This is a candidate, not proof of execution or compatibility.Shell: RESTRICTED_ACCESS_BLUR_MARKER. Privileges: RESTRICTED_ACCESS_BLUR_MARKER.preconditions: RESTRICTED_ACCESS_BLUR_MARKERdependencies: RESTRICTED_ACCESS_BLUR_MARKERverification: RESTRICTED_ACCESS_BLUR_MARKERfailure modes: RESTRICTED_ACCESS_BLUR_MARKERlimitations: RESTRICTED_ACCESS_BLUR_MARKERcleanup: RESTRICTED_ACCESS_BLUR_MARKER