windows enabled community high v1.0.0

msdeploy

Microsoft tool used to deploy Web Applications. Located at: C:\Program Files\IIS\Microsoft Web Deploy V2\msdeploy.exe; C:\Program Files (x86)\IIS\Microsoft Web Deploy V2\msdeploy.exe; C:\Program Files\IIS\Microsoft Web Deploy V3\msdeploy.exe.

📋 Live Preview 
msdeploy
msdeploy

Sandbox: execFile · Timeout: 30s

Capabilities

security.execution.command
security.defense-evasion.bypass
system.file.copy

Contract

Outputs

process.output

Command execution output

Side effects: filesystem_writeprocess_spawn

Workflow Edges

Produces

process.output

Resource Profile

ResourceValue
CPUlow
Memory16 MB
Networklow
Disk I/Olow

Examples

Launch .bat file via msdeploy.exe. (Local execution of batch file using msdeploy.exe.)

msdeploy.exe -verb:sync -source:RunCommand -dest:runCommand="{PATH_ABSOLUTE:.bat}"

Launch .bat file via msdeploy.exe. (Local execution of batch file using msdeploy.exe.)

msdeploy.exe -verb:sync -source:RunCommand -dest:runCommand="{PATH_ABSOLUTE:.bat}"

Copy file from source to destination. (Copy file.)

msdeploy.exe -verb:sync -source:filePath={PATH_ABSOLUTE:.source.ext} -dest:filePath={PATH_ABSOLUTE:.dest.ext}

Detection

TypeRule / Indicator
sigma https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_lolbin_msdeploy.yml

Documentation

msdeploy

msdeploy is a Windows LOLBin. Microsoft tool used to deploy Web Applications. Located at: C:\Program Files\IIS\Microsoft Web Deploy V2\msdeploy.exe; C:\Program Files (x86)\IIS\Microsoft Web Deploy V2\msdeploy.exe; C:\Program Files\IIS\Microsoft Web Deploy V3\msdeploy.exe.

References