Analytics Informational
✕

Abnormal File Activity in SCCMContentLib Shared Folder by user

A user generated suspicious file activity within the SCCMContentLib shared folder, which is considered a high-value target for attackers.

Module:
Identity Analytics
Data source:
XDR Agent with eXtended Threat Hunting (XTH)
ATT&CK tactics: Credential Access (TA0006) Privilege Escalation (TA0004)
ATT&CK techniques: Valid Accounts: Domain Accounts (T1078.002) Unsecured Credentials (T1552)
Detector tags: Microsoft SCCM Analytics
Attacker's goals:

Attackers aim to exploit misconfigurations in Microsoft Configuration Manager to access sensitive data, such as credentials and certificates, stored within the SCCMContentLib. This access can facilitate lateral movement and further compromise within the network.

Investigative actions:

Verify the activity with the performing user. Check if SCCM admin credentials were accessed or exfiltrated. Review SCCM logs to identify unauthorized queries or modifications. Investigate recent access to the extracted files and their contents. Check other security logs (e.g., Windows Event Logs, SIEM alerts) for suspicious behavior. Identify the originating system and assess if it has been compromised. Monitor for any further lateral movement or privilege escalation attempts.

Test period:
30 Minutes
Deduplication:
1 Day
1 variation:
  • Suspicious File Activity in SCCMContentLib Shared Folder by user Low (parent: Informational)