Microsoft Configuration Manager device registration and policy request

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	1 Hour
Deduplication Period	1 Day
Required Data	XDR Agent
Detection Modules	Identity Analytics
Detector Tags	Microsoft SCCM Analytics
ATT&CK Tactic	Credential Access (TA0006), Privilege Escalation (TA0004)
ATT&CK Technique	Valid Accounts: Domain Accounts (T1078.002), Unsecured Credentials (T1552)
Severity	Informational

Description

A user registered a device and requested a Microsoft Configuration Manager policy.

Attacker's Goals

An attacker aims to extract plaintext credentials of the Network Access Account (NAA) from an SCCM environment, enabling unauthorized access to resources and lateral movement within the network.

Investigative actions

• Verify the activity with the performing user.
• Review related logs (e.g., Active Directory, SCCM logs) to identify the source of the modification and associated accounts.
• Look for unusual logins using the Network Access Account (NAA), on systems or at times that deviate from normal patterns.
• Looking for signs of credential extraction, such as tools or scripts.

Variations

Suspicious Microsoft Configuration Manager device registration and policy request

Synopsis

Field	Value
ATT&CK Tactic	Credential Access (TA0006), Privilege Escalation (TA0004)
ATT&CK Technique	Valid Accounts: Domain Accounts (T1078.002), Unsecured Credentials (T1552)
Severity	Low

Description

A suspicious process registered a new device and requested policies from Microsoft Configuration Manager, triggering a suspicious activity alert due to unusual characteristics.

Attacker's Goals

An attacker aims to extract plaintext credentials of the Network Access Account (NAA) from an SCCM environment, enabling unauthorized access to resources and lateral movement within the network.

Investigative actions

• Verify the activity with the performing user.
• Review related logs (e.g., Active Directory, SCCM logs) to identify the source of the modification and associated accounts.
• Look for unusual logins using the Network Access Account (NAA), on systems or at times that deviate from normal patterns.
• Looking for signs of credential extraction, such as tools or scripts.