User added to the SMS Admins local group

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	3 Hours
Deduplication Period	1 Day
Required Data	Requires one of the following data sources: Windows Event Collector OR XDR Agent with eXtended Threat Hunting (XTH)
Detection Modules	Identity Analytics
Detector Tags	Microsoft SCCM Analytics
ATT&CK Tactic	Persistence (TA0003), Privilege Escalation (TA0004)
ATT&CK Technique	Account Manipulation (T1098), Valid Accounts (T1078)
Severity	Low

Description

A user was added to the SMS Admins local group. This may indicate a potential attack targeting the Microsoft Configuration Manager infrastructure.

Attacker's Goals

Gain administrative control over Microsoft Configuration Manager to facilitate lateral movement, deploy malicious payloads, or exfiltrate data.

Investigative actions

• Verify the activity with the performing user.
• Confirm that the group addition was not accidental.
• Review related logs (e.g., Active Directory, SCCM logs) to identify the source of the modification and associated accounts.
• Investigate the user's activity before and after the addition to determine if any unauthorized actions or privilege escalation attempts occurred.

Variations

User added to the SMS Admins group and removed

Synopsis

Field	Value
ATT&CK Tactic	Persistence (TA0003), Privilege Escalation (TA0004)
ATT&CK Technique	Account Manipulation (T1098), Valid Accounts (T1078)
Severity	Medium

Description

A user was added to the SMS Admins group and removed within a short period of time, which may be a sign of compromise.

Attacker's Goals

Gain administrative control over Microsoft Configuration Manager to facilitate lateral movement, deploy malicious payloads, or exfiltrate data.

Investigative actions

• Verify the activity with the performing user.
• Confirm that the group addition was not accidental.
• Review related logs (e.g., Active Directory, SCCM logs) to identify the source of the modification and associated accounts.
• Investigate the user's activity before and after the addition to determine if any unauthorized actions or privilege escalation attempts occurred.