Potential extraction of NAA Account Credentials in Microsoft Configuration Manager

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	3 Hours
Deduplication Period	1 Day
Required Data	Requires all of the following: AzureAD Audit Log Microsoft Graph Logs Office 365 Audit Okta Palo Alto Networks Global Protect OR Third-Party VPNs XDR Agent XDR Agent with eXtended Threat Hunting (XTH)
Detection Modules	Identity Analytics
Detector Tags	Microsoft SCCM Analytics
ATT&CK Tactic	Credential Access (TA0006), Defense Evasion (TA0005)
ATT&CK Technique	Unsecured Credentials (T1552), Deobfuscate/Decode Files or Information (T1140), Credentials from Password Stores (T1555)
Severity	Low

Description

Possible user attempt to deobfuscate Network Access Account (NAA) credentials in Microsoft Configuration Manager. This may indicate a compromised account.

Attacker's Goals

An attacker may extract plaintext credentials of the Network Access Account (NAA) from an SCCM environment to access resources and lateral movement within the network.

Investigative actions

• Verify the activity with the performing user.
• Review related logs (e.g., Active Directory, SCCM logs) to identify the source of the modification and associated accounts.
• Look for unusual logins using the Network Access Account (NAA), on systems or at times that deviate from normal patterns.
• Looking for signs of credential extraction, such as tools or scripts.

Variations

Suspicious extraction of NAA Account Credentials in Microsoft Configuration Manager

Synopsis

Field	Value
ATT&CK Tactic	Credential Access (TA0006), Defense Evasion (TA0005)
ATT&CK Technique	Unsecured Credentials (T1552), Deobfuscate/Decode Files or Information (T1140), Credentials from Password Stores (T1555)
Severity	Medium

Description

Possible user attempt to deobfuscate Network Access Account (NAA) credentials in Microsoft Configuration Manager. This may indicate a compromised account.

Attacker's Goals

An attacker may extract plaintext credentials of the Network Access Account (NAA) from an SCCM environment to access resources and lateral movement within the network.

Investigative actions

• Verify the activity with the performing user.
• Review related logs (e.g., Active Directory, SCCM logs) to identify the source of the modification and associated accounts.
• Look for unusual logins using the Network Access Account (NAA), on systems or at times that deviate from normal patterns.
• Looking for signs of credential extraction, such as tools or scripts.