Suspicious access of the System Management Container

Analytics BIOC Low

Suspicious access of the System Management Container

A user accessed the System Management container, which may be an indication of a reconnaissance for site servers.

Module:: Identity Analytics
Data source:: Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

ATT&CK tactics: Reconnaissance (TA0043)

ATT&CK techniques: Gather Victim Network Information (T1590)

Detector tags: Microsoft SCCM Analytics

Attacker's goals:

An attacker is attempting to enumerate Microsoft Configuration Manager and identify accessible site servers.

Investigative actions:

Look for the suspicious LDAP query that may trigger this event. Check if the process executes LDAP search queries as part of its normal behavior. Investigate any other potentially suspicious behavior from the compromised user. Looking for suspicious activity or logins to the Microsoft Configuration Manager site server.

Test period:: N/A (single event)
Deduplication:: 1 Day