Unmasking SCCM Application Execution
#specterops

TL;DR: Executing applications instead of scripts via SCCM’s deploy application feature will generate different artifacts due to the fundamental differences in the execution flow. While existing detection tools can catch script-based execution, they often miss stealthier methods. This post covers how to detect the more evasive SCCM application execution. Introduction: During BlackHat 2025’s offering of […]

The post Unmasking SCCM Application Execution appeared first on SpecterOps.

via SpecterOps Blog (author: Joshua Prager)