Researchers expose Microsoft SCCM misconfigs usable in cyberattacks

Security researchers have created a knowledge base repository for attack and defense techniques based on improperly setting up Microsoft's Configuration Manager, which could allow an attacker to execute payloads or become a domain controller. Configuration Manager (MCM), formerly known as System Center Configuration Manager (SCCM, ConfigMgr), has been around since 1994 and is present in many Active Directory environments, helping administrators manage servers and workstations on a Windows network. It has been the object of security research for more than a decade as an attack surface [1, 2, 3] that could help adversaries gain administrative privileges on a Windows domain. At the SO-CON security conference today, SpecterOps researchers Chris Thompson and Duane Michael announced the release of Misconfiguration Manager, a repository with attacks based on faulty MCM configurations that also provides resources for defenders to harden their security stance "Our approach extends beyond cataloging the tactics of known adversaries to include contributions from the realm of penetration testing, red team operations, and security research," the SpecterOps researchers explain. The two researchers say that MCM/SCCM is not easy to set up and that many of the default configurations leave room for attackers to take advantage. In a blog post, Michael illustrates that the most common and damaging misconfiguration researchers see in their engagements are network access accounts (NAA) with too m...