Analytics
Informational
✕
Microsoft Configuration Manager device registration and policy request
A user registered a device and requested a Microsoft Configuration Manager policy.
- Module:
- Identity Analytics
- Data source:
- XDR Agent
ATT&CK tactics: Credential Access (TA0006) Privilege Escalation (TA0004)
ATT&CK techniques: Valid Accounts: Domain Accounts (T1078.002) Unsecured Credentials (T1552)
Detector tags: Microsoft SCCM Analytics
Attacker's goals:
An attacker aims to extract plaintext credentials of the Network Access Account (NAA) from an SCCM environment, enabling unauthorized access to resources and lateral movement within the network.
Investigative actions:
Verify the activity with the performing user. Review related logs (e.g., Active Directory, SCCM logs) to identify the source of the modification and associated accounts. Look for unusual logins using the Network Access Account (NAA), on systems or at times that deviate from normal patterns. Looking for signs of credential extraction, such as tools or scripts.
- Test period:
- 1 Hour
- Deduplication:
- 1 Day
1 variation:
- Suspicious Microsoft Configuration Manager device registration and policy request Low (parent: Informational)