Software Deployment Tools
Technique · ATTACK:enterprise:T1072
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1072",
"title": "Software Deployment Tools",
"type": "Technique",
"source_url": "https://attack.mitre.org/techniques/T1072",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--92a78814-b191-47ca-909c-1ccfe3777414",
"external_id": "T1072",
"domain": "enterprise",
"created": "2017-05-31T21:30:57.201Z",
"modified": "2026-05-12T15:12:00.705Z",
"version": "3.2",
"aliases": [
],
"tactics": [
"execution",
"lateral-movement"
],
"source_references": [
{
"source_name": "Fortinet Zero-Day and Custom Malware Used by Suspected Chinese Actor in Espionage Operation",
"url": "https://www.mandiant.com/resources/blog/fortinet-malware-ecosystem"
},
{
"source_name": "SpecterOps Lateral Movement from Azure to On-Prem AD 2020",
"url": "https://posts.specterops.io/death-from-above-lateral-movement-from-azure-to-on-prem-ad-d18cb3959d4d"
},
{
"source_name": "Mitiga Security Advisory: SSM Agent as Remote Access Trojan",
"url": "https://www.mitiga.io/blog/mitiga-security-advisory-abusing-the-ssm-agent-as-a-remote-access-trojan"
}
]
}Explicit source assertions (22)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:M1018 → mitigates → ATTACK:enterprise:T1072
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0dfd9bcd-f9e2-44c1-9d87-07c626644561
ATTACK:enterprise:M1015 → mitigates → ATTACK:enterprise:T1072
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--147b8bb5-ca4e-455e-a5b9-f0ab118c67eb
ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1072
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1d3654f8-3a5e-4ef8-826f-4242ecf78c0a
FireEye APT32 May 2017ATTACK:enterprise:M1051 → mitigates → ATTACK:enterprise:T1072
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--33a54656-6370-4c22-af67-4ff528ba1568
ATTACK:enterprise:G0034 → uses → ATTACK:enterprise:T1072
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3fdd32ab-646e-4ba4-96fd-165a09db0c67
Microsoft Prestige ransomware October 2022ATTACK:enterprise:M1026 → mitigates → ATTACK:enterprise:T1072
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--43eebb80-4b8a-4690-a7e3-5f6f8e08db9f
ATTACK:enterprise:G0129 → uses → ATTACK:enterprise:T1072
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--58aa294e-c14c-45f8-80e6-9b05229cbb0f
Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023 · Trend Micro Mustang Panda Earth Preta Toneshell February 2025ATTACK:enterprise:G1055 → uses → ATTACK:enterprise:T1072
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--692d7e4a-1208-4626-9bd2-209bc6b2d4f5
SPECOPS Outpost24 Handala Hack Stryker March 2026 · Palo Alto VOID MANTICORE Iran Cyber Threats March 2026ATTACK:enterprise:G0091 → uses → ATTACK:enterprise:T1072
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6fc128ed-90f3-4933-8ad7-4fd4a04cb39f
Group IB Silence Sept 2018ATTACK:enterprise:M1027 → mitigates → ATTACK:enterprise:T1072
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7a20546a-c6be-4c1b-8b41-23cfb551f933
ATTACK:enterprise:S0041 → uses → ATTACK:enterprise:T1072
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--82268341-e0a8-4937-8618-351e147daa0c
Dell WiperATTACK:enterprise:M1033 → mitigates → ATTACK:enterprise:T1072
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--87cf80be-bae1-4a12-a754-38cad36724ac
ATTACK:enterprise:M1030 → mitigates → ATTACK:enterprise:T1072
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8eaad388-b7ef-4fb8-88e6-c6f36065c8c4
ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1072
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8f4b9d5d-6ad7-4cca-9869-551604450f91
ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1072
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9a8dbb5c-c590-41ea-9404-0c78d6ae2d2a
CISA_AA25-239ASaltTyphoon_Sept2025ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1072
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--af3b443b-36e3-4b72-ad8a-1b84f214b282
Mandiant_UNC1549TTPsTools_Nov2025ATTACK:enterprise:G0028 → uses → ATTACK:enterprise:T1072
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b38cfcfd-b8e3-4a9c-ade9-8a8bfeb04694
Dell TG-1314ATTACK:enterprise:G1057 → uses → ATTACK:enterprise:T1072
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c331ae1d-c490-4366-9b39-e2b68073e606
SOCRadar_ShinyHunters_Mar2024ATTACK:enterprise:M1032 → mitigates → ATTACK:enterprise:T1072
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c869db21-9c91-4449-b316-408bcab56e1b
ATTACK:enterprise:C0018 → uses → ATTACK:enterprise:T1072
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e2ac0292-0de5-4805-9ff8-f56881331295
Cisco Talos Avos Jun 2022ATTACK:enterprise:M1029 → mitigates → ATTACK:enterprise:T1072
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e4236234-0fd7-426f-b55a-d32364e3a64e
ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1072
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f5c91894-57ae-4e16-945f-8ad04f9c2d85
CISA Medusa Group Medusa Ransomware March 2025