subat0mik/misconfiguration-managerMisconfiguration Manager is a central knowledge base for all known Microsoft Configuration Manager tradecraft and associated defensive and hardening guidance.
This repository serves as a central knowledge base for all known Microsoft Configuration Manager (a.k.a. MCM, ConfigMgr, System Center Configuration Manager, or SCCM) tradecraft and associated defensive and hardening guidance. Our goal is to help demystify SCCM tradecraft and simplify SCCM attack path management for defenders while also educating offensive security professionals on this nebulous attack surface. Designed to go beyond the static nature of whitepapers, this living repository documents known SCCM misconfigurations and their abuses and encourages ongoing contributions from the community to enhance its relevance and utility.
We've curated this repository to raise awareness of the rapidly evolving SCCM threat landscape, drawing inspiration from the MITRE ATT&CK framework, with a few deviations. We were also strongly influenced by Push Security's SaaS attack techniques matrix as well as Will Schroeder and Lee Chagolla-Christensen's Certified Pre-Owned whitepaper.
Our approach extends beyond cataloging the tactics of known adversaries to include contributions from the realm of penetration testing, red team operations, and security research. At SpecterOps, we've leveraged many misconfigurations highlighted in this repository in real-world environments, while others represent experimental and exploratory research projects proved out in a lab environment.
This project also serves as a central point of reference for all of the SCCM attack and defense resources that we're aware of.
We openly invite you to submit both proven and exploratory SCCM-focused attack techniques and defensive strategies and resources to this project and to provide any feedback and recommendations about the content in this repository.
For more of an introduction to the project, please reference our blog and conference talks:
Refer to the SCCM Attack Matrix and SCCM Attack and Defense Matrix below, which map attack techniques to their MITRE ATT&CK framework tactics, as well as to their detection and prevention strategies.
Offensive security practitioners may also benefit from reviewing the list of known and documented Attack Techniques, which identifies the security context and network access that are required for each technique.
Defenders and IT administrators may benefit from reviewing the list of known and documented Defense Techniques, which identifies the administrator roles we think are most likely to be involved in the implementation of each item.
Curious about how a hierarchy can be completely compromised in certain, mostly default conditions? Check out the list of TAKEOVER techniques.
If you aren't familiar with a term used in a technique's description, refer to the glossary page, which contains definitions for terms commonly used in SCCM.
If you'd like to test these techniques in a lab environment or learn more about SCCM attack and defense, please refer to the resources page, which contains links to all the SCCM lab and attack/defense resources that we are aware of, many of which inspired and informed the information in this repository.
We've included a script that will audit many of the misconfigurations included in this repo. For more information about the script and how to use it, please reference our blog post.
If we've overlooked anything or are missing credits for prior work, please reach out to us or submit a pull request and we'd be happy to make updates.
