SpecterOps research highlights that executing applications via SCCM’s deploy application feature generates different artifacts compared to script-based execution, often evading existing detection tools. This post details how to detect these stealthier SCCM application execution methods. Understanding these differences is crucial for security teams to improve their detection capabilities against advanced persistent threats leveraging SCCM.