ADTIER-004: Cuentas de servicio de gestión de configuración en grupos privilegiados
- Plataforma
- Active Directory
- Categoría
- Tier-0 Hygiene & Hybrid Identity Surface
- Severidad
- Critical
- Pilar de Zero Trust
- Identity (peso 2)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Las plataformas de gestión de configuración (SCCM/MECM, Intune Connector, Jamf, KACE, Lansweeper, ManageEngine, Ivanti, BigFix) distribuyen software a cada endpoint por definición, por lo que ya son una plataforma privilegiada de movimiento lateral. SCCM en particular tiene primitivas de abuso bien conocidas (exposición de la Network Access Account, coacción NTLM al servidor de sitio, client push). Una cuenta de servicio de gestión de configuración en Domain Admins otorga a un atacante que llegue a cualquier endpoint gestionado las llaves del dominio.
Por qué importa
Configuration-management products are not ordinary applications. By design they execute code as SYSTEM on every managed endpoint, hold credentials that authenticate to every managed endpoint, and store policy that any client can request. That property makes them an out-of-band Tier-0 system regardless of where they sit on the org chart. SCCM in particular has a documented chain of abuse primitives, each of which has been weaponised in public tooling (SharpSCCM, CMLoot, Misconfiguration Manager): the Network Access Account password is encrypted with a key derivable by any authenticated client and can be recovered with a single WMI query; the site server can be coerced to authenticate to an attacker-controlled relay over NTLM via PrinterBug, PetitPotam, or DFSCoerce, and that authentication can be relayed to LDAP or AD CS for elevation; client-push installation uses the configured push account against any host the attacker can add to the site database; and the SCCM site database holds the BitLocker recovery keys, OS deployment task sequence variables, and application install scripts for the entire estate. If the service account or the site server machine account is a Domain Admin, every one of those primitives becomes a one-step path from a managed workstation to krbtgt. The same logic applies to Intune Connector for AD (it holds the credential used to join Autopilot devices to the on-premises domain), Jamf binding accounts, KACE and Lansweeper inventory accounts, and BigFix relay service accounts.
Ruta de ataque
1. Foothold on any managed client. The attacker phishes, exploits, or buys access to a workstation enrolled in the configuration-management estate. 2. NAA disclosure (SCCM). The attacker queries the local WMI namespace root\ccm\policy\Machine\ActualConfig for CCM_NetworkAccessAccount instances, then decrypts the NetworkAccessUsername and NetworkAccessPassword with the DPAPI master key available to SYSTEM. Tools: SharpSCCM get secrets, CMLoot, MalSCCM. If the NAA is a Domain Admin, the attacker now holds DA credentials. 3. NTLM coercion to site server. The attacker triggers the site server, the SMS Provider, or a management-point machine account to authenticate to an attacker-controlled relay. Coercion primitives: PrinterBug (MS-RPRN), PetitPotam (MS-EFSR), DFSCoerce (MS-DFSNM), ShadowCoerce (MS-FSRVP). The relayed authentication is forwarded to LDAP, ADCS HTTP, or SMB. If the site server machine account is a Domain Admin, the relayed authentication yields direct DA-equivalent access. 4. Site takeover via SMS Provider. With local admin on the site server (often inherited because the service account is a DA, or because the site server machine account is a DA and was relayed), the attacker becomes a Full Administrator inside SCCM, then deploys an arbitrary application or task sequence to any device collection. This includes targeting Domain Controllers if they happen to be managed by the same site, which is common. 5. Client push abuse. The attacker adds a controlled host to the site database, triggers client push installation, and harvests the push installation account credential from the resulting authentication. If client push is configured with a Domain Admin, every push installation leaks that credential to whichever host the attacker chose. 6. Lateral movement to every managed endpoint. With SCCM Full Administrator (or equivalent in the other products) the attacker deploys a malicious application or script to a collection containing the entire estate, achieving SYSTEM execution everywhere in minutes. This is the path taken by multiple ransomware crews that abuse SCCM as a distribution backbone for the encryptor.
Cómo lo evalúa Guerrilla
Guerrilla performs the candidate-account discovery entirely over LDAP so the check works against any reachable DC without RSAT or the ConfigurationManager PowerShell module loaded locally. For each domain it binds to a writable DC, resolves the well-known Tier-0 SIDs, and reads the member attribute of each Tier-0 group with range-retrieval to handle membership counts above the LDAP page size. Recursive expansion is performed in PowerShell so nested groups, foreign-security-principals from forest trusts, and tombstoned references are surfaced rather than silently dropped. The candidate set is then computed with two parallel LDAP filters: a sAMAccountName / description / userPrincipalName substring match across the supported product list, and an SPN match against the known SCCM and MECM SPN classes (SMS_SITE_SYSTEM, SMS_SQL_SERVER, MP_, DP_) plus MSSQLSvc SPNs whose hostname matches a discovered site system. Site systems themselves are discovered by searching the System Management container (CN=System Management,CN=System,DC=...) for objects of class mSSMSManagementPoint, mSSMSServerLocatorPoint, and mSSMSSite. Every match is intersected with the Tier-0 membership set, and the resulting findings are emitted with the principal DN, the matched product signature, the Tier-0 group reached, and the path used to reach it (direct membership, nested group chain, or computer-object membership for site-server machine accounts).
Valor recomendado
Las cuentas de servicio de gestión de configuración están acotadas a sus derechos mínimos documentados y nunca están en Domain Admins / Enterprise Admins. La Network Access Account de SCCM es una identidad dedicada no privilegiada.
Remediación
Identifique el producto de gestión de configuración y revise los derechos de la cuenta de servicio. Para SCCM: asegúrese de que la Network Access Account no sea privilegiada (NO un Domain Admin); asegúrese de que la cuenta de equipo del servidor de sitio no sea un Domain Admin; revise las cuentas de servicio de la jerarquía en busca de mínimo privilegio. Mueva los servidores de sitio y los puntos de gestión a una OU de Tier 0 con inicios de sesión restringidos.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-6
- CIS AD Benchmark
- 8.2.3
- MITRE ATT&CK
- T1072, T1078.002