PW-035Attack pathTrusts, management planes and other systems

Tier Zero computer managed by SCCM from outside Tier Zero

A domain controller or other Tier Zero host is managed by SCCM, and people outside Tier Zero can use SCCM to run code on it.

Category: Attack Path
Severity: At least High.
Typical owner: the SCCM (Configuration Manager) team, with the Tier Zero owners
Data needed: ConfigManBearPig's OpenGraph output, read with its built-in mapping pack^*. That pack is untrusted until you trust it (trust = ["configmanbearpig"] under [opengraph] in pathwarden.toml, or on the app's Mappings page); until then its data is context only. See the OpenGraph guide.

MITRE ATT&CKT1072

Most useful toDefensive engineers Identity and access engineers Offensive operators

On this page

In plain language

Microsoft Configuration Manager (SCCM, also called MECM) installs software and runs scripts on the computers it manages, as SYSTEM. That is its job, so whoever can deploy to a computer through SCCM controls that computer.

When a domain controller is an SCCM client, every SCCM administrator whose collections include it, and whoever takes over the SCCM site, controls the domain. SCCM administrators are rarely protected like Domain Admins, and SCCM has well-documented takeover techniques of its own. Either keep Tier Zero hosts out of SCCM, or treat SCCM and its administrators as Tier Zero.

What Pathwarden flags

A Tier Zero computer (a domain controller, a CA server, a computer you declared Tier Zero) is an SCCM client, and accounts or groups outside Tier Zero can administer it through SCCM: a Full or Application Administrator of a collection that holds it, an administrator of the whole site, or whoever controls the site database. Each of them can deploy an application, script or task sequence that runs as SYSTEM on the computer.

There is one finding per computer. The evidence comes from ConfigManBearPig (an OpenGraph file, see docs/opengraph.md): its role-based administration, client and site database records. Its "assumed" relay and co-location relationships are never part of the finding. PW-025 reports the site server itself when the directory shows it.

How attackers use it

Configuration Manager is a code-execution service by design. Misconfiguration Manager's TAKEOVER and ELEVATE techniques are all routes to site control, and site control is SYSTEM on every client, domain controllers included. An SCCM administrator account is rarely protected like a Domain Admin, so it is a cheaper target.

Find it with Pathwarden

Data needed: ConfigManBearPig's OpenGraph output, read with its built-in mapping pack^*. That pack is untrusted until you trust it (trust = ["configmanbearpig"] under [opengraph] in pathwarden.toml, or on the app's Mappings page); until then its data is context only. See the OpenGraph guide.

In the web UI or the HTML report, open the Findings tab and expand PW-035: each finding shows who can use it (its exposure), the attack path drawn out, the affected objects, and the fix. The remediation path tells you whether a single plan step closes it. On the command line:

Shell

# every finding of this rule, with its path and fix
pathwarden findings -i .\collect --rule PW-035
# the step-by-step guide on this page, offline
pathwarden guide PW-035
# after the fix: collect again, then check it is gone
pathwarden retest -i .\collect-after --rule PW-035

Exit codes make retest easy to script: 0 Fixed, 1 Still open, 3 Can't tell. See findings lifecycle and retest.

Before you change anything

In the Configuration Manager console, check which collections hold the computer and which administrative users have rights on them (Administration > Security > Administrative Users, and each user's security scopes and collections).
Decide which way to go: SCCM is either part of Tier Zero, or it must not manage Tier Zero.
Note the current collection memberships and role assignments.

How to fix it

Option A: Take Tier Zero out of SCCM (recommended)

Remove the client from the Tier Zero computers (ccmsetup.exe /uninstall), and exclude them from discovery and boundary groups so it isn't pushed again.
Or manage them from a separate site, or a hierarchy, administered only by Tier Zero admins.

Option B: Make SCCM Tier Zero

Treat the site server, SMS Providers, the site database server, every Full Administrator and every administrator of a collection that holds Tier Zero computers as Tier Zero. Limit the roles of everyone else to collections without Tier Zero computers, add those servers under Additional Tier Zero in Settings, and fix what PW-003 and PW-004 report about them.

Hardening either way

Require Extended Protection on the site database, SMB signing on site systems, PKI or Enhanced HTTP instead of a network access account, no client push account with admin rights on Tier Zero, and multi-admin approval for scripts.

PowerShell (ConfigurationManager module)

PowerShell

# Administrative users, their roles and collections
Get-CMAdministrativeUser | Select-Object LogonName, RoleNames, CollectionNames

# Collections a device is in
Get-CMDevice -Name "<Computer>" | Get-CMResultantCollection | Select-Object Name, CollectionID

# Remove a collection from an administrative user's scope
Remove-CMCollectionFromAdministrativeUser -AdministrativeUserName "<Domain>\<User>" -CollectionName "<Collection>"

Verify the fix

Collect again with ConfigManBearPig and its coverage file, then analyze the new collection. The finding is fixed when the computer is no longer a client, or only Tier Zero accounts and groups administer it. Without a coverage file it stays open as "can't tell".

Roll back

Reinstall the client (ccmsetup.exe with your usual properties) or restore the administrative user's collections and roles from your notes.

References

Misconfiguration Manager: SCCM attack and defense techniquesgithub.com
Microsoft: Role-based administration fundamentals (Configuration Manager)learn.microsoft.com
Microsoft: Enterprise access modellearn.microsoft.com
ConfigManBearPig (SpecterOps)github.com
SpecterOps: Introducing ConfigManBearPig, a BloodHound OpenGraph collector for SCCMspecterops.io
MITRE ATT&CK T1072: Software Deployment Toolsattack.mitre.org

Very new and undergoing testing. These features haven't received a lot of testing yet. Try them out and let us know what's working.