T1072

Software Deployment Tools

Abusing a system that installs software on many hosts (WSUS, SCCM) to run code on them.

How it shows up on Hack The Box

On HTB it shows up with WSUS: if you control the update server you can offer the client a Microsoft-signed binary (PsExec) with your arguments.

Techniques in our catalog that match this one (the number is their machines):

Machines to practice it

Sorted from easiest to hardest. The ▶ link takes you to the minute of the IppSec video where it is used.