SlideShare a Scribd company logo

Using SCCM to Spread Malware

•
•
E
enigma0x3

This document discusses using Microsoft's System Center Configuration Manager (SCCM) for both offensive and defensive purposes. It introduces PowerSCCM, a PowerShell toolkit for interacting with SCCM. PowerSCCM can be used to create malicious applications and deploy them to targeted collections of machines. It also provides cmdlets for hunting for compromised users and systems. The document recommends tuning SCCM for improved host-based security monitoring and inventory capabilities. It provides examples of using SCCM data for incident response and hunting activities on the network.

Technology
1 of 52
Download to read offline
Up is Down, Black is White: Using SCCM for Wrong and Right Matt Nelson, Will Schroeder Veris Group’s Adaptive Threat Division
@enigma0x3 ❖ Penetration Tester and Red Teamer for the Adaptive Threat Division (ATD) of Veris Group ❖ Active developer on the PowerShell Empire project ❖ Offensive PowerShell advocate ❖ Sysadmin while in college ❖ Cons: Shmoocon (Firetalks), BSides DC
@harmj0y ❖ Security researcher and red teamer for the Adaptive Threat Division of Veris Group ❖ Co-founder and active developer of the Veil- Framework | PowerTools | Empire ❖ PowerSploit developer ❖ Microsoft CDM/PowerShell MVP ❖ Cons: Shmoocon, DEF CON, DerbyCon, various BSides (including BSides Boston!)
tl;dr ● Background ○ Red Teaming vs. Pentesting ○ Hunting vs. Incident Response ○ Basics of SCCM ○ SCCM in the enterprise ● Using and Abusing SCCM ○ SCCM as an attack platform ○ Introducing PowerSCCM ○ Using PowerSCCM for Evil ○ Using PowerSCCM for Good ○ Demo
Background Pentesting vs Red Teaming Hunting vs Incident Response
Pentesting ● Pentesting doesn’t have a universal definition ● Could be: ○ A single person running a (slightly) glorified vuln scan ○ A few testers for 1-2 weeks ○ A multi-week assault with a large team ● We view pentesting as focused on breadth- find as many holes as possible and see how far you can get in a limited timeframe with open source tools
Our View of Red Teaming ● We view a red team engagement as an opportunity to test an organization’s incident response capabilities ○ We don’t remove logs ○ Ideally, parts of the engagement are ‘caught’ and others aren’t ○ We want to find a client’s ‘noise’ threshold ● General idea: simulate a reasonably “advanced” generic attacker, not a specific adversary
Incident Response ● “Five alarm fire” concept ● Kicked off by: ○ Network monitoring alerts ○ Third party service notification ○ Public breach/disclosure ● Reactive, by the time you notice something went wrong it’s often too late
Hunting ● US Department of Defense concept ● The blue version of the “assume breach” mentality ● Detection, Investigation, Response ○ Deny, Degrade, Disrupt, Manipulate ● Much more proactive ○ Assume you’re owned, search for evidence of compromise
“Fundamentally, if somebody wants to get in, they're getting in...Accept that...What we tell clients is: Number one, you're in the fight, whether you thought you were or not. Number two, you're almost certainly penetrated.” Assume Breach Michael Hayden Former Director of CIA & NSA
SCCM Microsoft’s System Center Configuration Manager
What is SCCM? ● “System Center Configuration Manager” ○ Platform for distributing packages to clients ○ Packages, applications and install scripts are hosted on the SCCM server itself ● Setup and maintained via an agent/server architecture ● Essentially acts as internal RAT/C2 ○ Agents check in to server periodically to obtain new packages/applications
SCCM in the Enterprise ● One central site server with multiple distribution points ● Often setup/configured using a service account to run the application/push updates ● Application contents (*cough, cough install scripts and notes*) are hosted on a publicly available share ● Admins gonna admin
SQL vs. WMI for SCCM Management ● SCCM uses a combination of SQL and WMI to store lots of client information ○ Some of this can be viewed directly through the Configuration Manager interface, some can’t ● Bypassing the SCCM frontend and going straight for the backend can be tricky ○ Determining which method (SQL/WMI) to retrieve information or update information can also be a challenge as both have their advantages and disadvantages
SQL ● SCCM utilizes a ‘normal’ SQL Server 2012 backend ○ Great for information retrieval (useful for Hunt) ○ Finicky for data modification ( for Red Teaming) ● Using SQL for pulling information from SCCM requires in-depth knowledge of the backend database ○ SCCM pulls from multiple locations for one requested piece of information
SQL Schema
SQL Schema ● v_GS_SERVICE – currently installed services ● v_HS_SERVICE – historical information on installed services ● v_GS_AUTOSTART_SOFTWARE – information about programs in a few auto start locations (note that this is not as complete as something like Autoruns) ● v_GS_PROCESS – information on currently running processes ● v_HS_PROCESS – historical information on running processes ● v_GS_CCM_RECENTLY_USED_APPS – information on recently used applications ● v_GS_SYSTEM_DRIVER – details on drivers currently installed ● v_GS_SYSTEM_CONSOLE_USER – information on console usage, complete with user information ● v_GS_SoftwareFile – details on inventoried files (more on this in ‘Tuning SCCM for Defense’ below) ● v_GS_BROWSER_HELPER_OBJECT – information on installed browser helper objects ● vMDMUsersPrimaryMachines – details on primary user -> machine mappings
WMI ● SCCM’s WMI can be queried/updated using WMI Query Language (WQL) or PowerShell’s Get-WMIObject wrapper ○ Much easier for modification (instead of querying), so WMI tends to be better for red teaming ● WMI allows us to customize properties to fit SCCM’s requirements ○ For example, SCCM Applications require XML that defines the properties of the application (hidden, rights to run as, etc).
WMI Schema
Listing all Applications: WMI vs SQL ● WMI: ○ SELECT * FROM SMS_Application ● SQL:
PowerSCCM Our PowerShell SCCM Toolkit
● Encountered SCCM multiple times throughout many engagements but often ignored it due to our unfamiliarity ● Not a lot of public information on abusing it for malicious purposes and the process to actually abuse it was often tedious and manual ○ David Kennedy and Dave DeSimone gave a nice presentation on using SCCM at Defcon 20 (Owning One to Rule Them All) Background/Motivations
Basic Usage ● Find-LocalSccmInfo: find the SCCM server/site code for a local machine ● New-SCCMSession: initiates a new session to the SCCM site server ○ Takes server name/site code/connection type ● Get-SccmSession: returns established sessions, pipeable to other functions ○ e.g. : Get-SccmSession | Get-SCCMApplication ● Remove-SccmSession: kill a SCCM session
Session Model
Session Model
SCCM as an Attack Platform Using Admins’ Tools Against Them
Hiding in Plain Sight ● SCCM traffic is completely normal in an enterprise network ● Admins and security staff have a harder time picking out malicious activity if it uses already existing technology. ● Instead of looking “like an adversary”, become a system administrator! ○ Utilize tools that exist and are expected in a target network
Attacking SCCM Without DA ● Contrary to popular belief, attacking SCCM does not require Domain Admin rights ○ all you need is local admin rights on the SCCM server! ● Most organizations try to practice the concept of least privilege ● If you can compromise a server administrator or SCCM admin, you can compromise SCCM, and every machine administered by SCCM
Targeting SCCM Admins ● PowerView’s Get-NetGroup function allows you to hunt for groups pertaining to SCCM ○ Get-NetGroup -GroupName *sccm* ● For domain users, some organizations separate out administrative functionality into multiple accounts for the same person ○ Group correlation can sometimes get a bit complicated ○ See Troopers 2016 “I Have the Power(View)”
SCCM for code execution ● SCCM clients constantly check the SCCM server for any new content deployed to them ● We can: ○ Host a binary payload on an accessible share ○ Create a malicious deployment package/application ○ Push the application out to a target machine collection ● And the code executes as SYSTEM!
Using PowerSCCM for ‘Evil’ Weaponizing Offensive SCCM
Offensive Cmdlets New-SccmCollection Create a SCCM collection to place target computers/users in for application deployment. Add-SccmDeviceToCollection Add a computer to a device collection for application deployment. Add-SccmUserToCollection Add a domain user to a user collection for application deployment. New-SccmApplication Creates a hidden application via WMI that can be deployed to any collection. This application will not show up in the Configuration Manager Console New-SccmApplicationDeployment Deploys an application to a specific collection. Invoke-SCCMDeviceCheckin Forces all members of a collection to immediately check for Machine policy updates and execute any new applications available. Find-LocalSCCMInfo Queries the local SMS_Authority Class to determine the Site Code and the Management Point
Hunting for Users ● PowerSCCM can ‘hunt’ for hosts that a user of interest last logged into: ○ Get-SCCMSession | Get-SCCMComputer | ?{$_. LastLogonUserName -eq "Matt"} ● You can also derive this information by observing the console usage logged by SCCM for each client: ○ Get-SCCMsession | Get-SccmConsoleUsage - SystemConsoleUserFilter "LABMatt" | Select-Object SystemName
Hunting for Users (cont.)
Grouping our Targets ● SCCM pushes content out only to specified user/device groups (known as “collections”) ● After identifying where our target users are logged in, we need to: ○ Group the targets into a device collection ○ Push out the malicious applications to the target collection ● Mass pwnage == bad , targeted/controlled pwnage == good
Grouping using PowerSCCM ● We can create the Device collection using the New-SccmCollection cmdlet: ○ Get-SCCMSession | New-SccmCollection - CollectionName “targets” -CollectionType “Device” ● With the collection created, we can add our target hosts into it by using the Add- SccmDeviceToCollection cmdlet: ○ Get-SCCMSession | Add-SccmDeviceToCollection - ComputerNameToAdd "CORPWKSTNX64" - CollectionName "targets"
Creating Malicious Applications ● PowerSCCM has heavily automated remotely creating malicious applications ○ This can be done entirely from a normal workstation (no RDP, etc.) by utilizing WMI ● SCCM stores a lot of the application info in the SMS_Application WMI class ○ We are able to create a new hidden application by populating the WMI class manually ○ Just set the ‘IsHidden’ field, yes it’s that easy
Creating Malicious Applications (cont.) ● This can be done using PowerSCCM’s New- SccmApplication cmdlet ○ Get-SccmSession | New-SccmApplication - ApplicationName "myApp" -PowerShellB64 "Y21kIC9jIGNhbGMuZXhlCg==" ● This will: ○ stuff our payload in a WMI class (Win32_Debug) on the SCCM server ○ open that class up to “everyone” ○ set the application to fetch the payload and execute it
Creating Malicious Applications (cont.)
Deploying Malicious Applications ● With targets grouped and applications created, deploying the application to the target group is the last step. ● PowerSCCM makes this simple to do via the New-SccmApplicationDeployment cmdlet:
Forcing Clients to Check-in ● After deploying the application, the client needs to check-in before it will execute it. ● We can force client to check-in outside of the normal interval with Invoke- SccmDeviceCheckin: ○ We invoke the “InitiateClientOperation” method in the SMS_ClientOperation WMI class on the SCCM Server
Using (Power)SCCM for ‘Good’ Why Not Use What’s Already Deployed?
SCCM As a Defensive Solution ● Since SCCM already acts as an inventory agent for machines it’s installed on, we can take advantage of a number of the information gathering compoments ● Previous (defensive) work: ○ “Using SCCM to violate best practices” by Brandon Helms ○ “Microsoft’s Accidental Enterprise DFIR Tool” by Keith Tyler ○ “SCCM (System Center Configuration Manager) and Incident Response” part 1 and part 2 on the Hexacorn blog ○ “Mining For Evil” by John McLeod and Mike Pilkington at the SANS 2013 DFIR Summit
Tuning SCCM For Defense (part 1) ● System Center Configuration Manager -> Administration -> ‘Client Settings’ -> client settings -> ‘Hardware Invetory’ -> Set Classes’ , ensure the following are enabled: ○ AutoStart Software – Asset Intelligence (SMS_AutoStartSoftware) ○ Browser Helper Object – Asset Intelligence (SMS_BrowserHelperObject) ○ Driver – VxD (Win32_DriverVXD) ○ Process (Win32_Process) ○ Recently Used Applications (CCM_RecentlyUsedApps) ○ Shares (Win32_Share) ○ System Console Usage – Asset Intelligence (SMS_SystemConsoleUsage) ○ System Console User – Asset Intelligence (SMS_SystemConsoleUser)
Tuning SCCM For Defense (Part 2) ● Ensure that under Settings -> ‘Software Metering’ is enabled and the schedule is what you want for your environment:
Tuning SCCM For Defense (Part 3) ● Under ‘Software Inventory’ set ‘Inventory these file types’ to all .exe’s on all hard disks:
Defensive Cmdlets Get-SccmService Information about the current set of running services on Sccm clients Get-SccmServiceHistory Information about the historical set of running services on Sccm clients Get-SccmAutoStart Information about programs registered in various autostart locations on Sccm clients Get-SccmProcess Information about the current set of running processes on Sccm clients Get-SccmProcessHistory Information about the historical set of running processes on Sccm clients Get-SccmRecentlyUsedApplication Information on recently launched applications on Sccm clients Get-SccmDriver Information on drivers installed on Sccm clients Get-SccmConsoleUsage Information on console usage on Sccm clients, complete with user information Get-SccmSoftwareFile Information on inventoried software files Get-SccmBrowserHelperObject Information on browser helper objects installed on Sccm clients
Defensive Cmdlets (Part 2) Find-SccmRenamedCMD Finds renamed cmd.exe executables using Get-SccmRecentlyUsedApplication and appropriate filters Find-SccmUnusualEXE Finds recently launched applications that don't end in *.exe using Get- SccmRecentlyUsedApplication and appropriate filters Find-SccmRareApplication Finds the rarest -Limit recently launched applications that don't end in *.exe using Get- SccmRecentlyUsedApplication and appropriate filters Find-SccmPostExploitation Finds recently launched applications commonly used in post-exploitation Find-SccmPostExploitationFile Finds indexed .exe's commonly used in post-exploitation Find-SccmMimikatz Finds launched mimikatz instances by searching the 'FileDescription' and 'CompanyName' fields of recently launched applications Find-SccmMimikatzFile Finds inventoried mimikatz.exe instances by searching the 'FileDescription' field of inventoried .exe's
SCCM and Splunk ● You can configure Splunk to automatically ingest from the SCCM SQL server under ‘Connections’: http://informationonsecurity.blogspot.com/2015/11/microsofts-accidental-enterprise-dfir.html
DEMOS
Questions? ● Get PowerSCCM: https://github. com/powershellmafia/PowerSCCM/ ● Read more: ○ Red: http://enigma0x3.net/2016/02/29/offensive- operations-with-powersccm/ ○ Blue: http://www.harmj0y.net/blog/defense/powersccm/ ● Contact us: ○ @enigma0x3 ○ @harmj0y ○ #psempire on Freenode

Recommended

Carlos García - Pentesting Active Directory Forests [rooted2019]
Carlos García - Pentesting Active Directory Forests [rooted2019]Carlos García - Pentesting Active Directory Forests [rooted2019]
Carlos García - Pentesting Active Directory Forests [rooted2019]RootedCON
 
Hunting for Credentials Dumping in Windows Environment
Hunting for Credentials Dumping in Windows EnvironmentHunting for Credentials Dumping in Windows Environment
Hunting for Credentials Dumping in Windows EnvironmentTeymur Kheirkhabarov
 
Windows Threat Hunting
Windows Threat HuntingWindows Threat Hunting
Windows Threat HuntingGIBIN JOHN
 
I hunt sys admins 2.0
I hunt sys admins 2.0I hunt sys admins 2.0
I hunt sys admins 2.0Will Schroeder
 
Catch Me If You Can: PowerShell Red vs Blue
Catch Me If You Can: PowerShell Red vs BlueCatch Me If You Can: PowerShell Red vs Blue
Catch Me If You Can: PowerShell Red vs BlueWill Schroeder
 
SANS Purple Team Summit 2021: Active Directory Purple Team Playbooks
SANS Purple Team Summit 2021: Active Directory Purple Team PlaybooksSANS Purple Team Summit 2021: Active Directory Purple Team Playbooks
SANS Purple Team Summit 2021: Active Directory Purple Team PlaybooksMauricio Velazco
 
PowerShell for Practical Purple Teaming
PowerShell for Practical Purple TeamingPowerShell for Practical Purple Teaming
PowerShell for Practical Purple TeamingNikhil Mittal
 
Hunting for Privilege Escalation in Windows Environment
Hunting for Privilege Escalation in Windows EnvironmentHunting for Privilege Escalation in Windows Environment
Hunting for Privilege Escalation in Windows EnvironmentTeymur Kheirkhabarov
 

Recommended

Carlos García - Pentesting Active Directory Forests [rooted2019]
Carlos García - Pentesting Active Directory Forests [rooted2019]Carlos García - Pentesting Active Directory Forests [rooted2019]
Carlos García - Pentesting Active Directory Forests [rooted2019]RootedCON
 
Hunting for Credentials Dumping in Windows Environment
Hunting for Credentials Dumping in Windows EnvironmentHunting for Credentials Dumping in Windows Environment
Hunting for Credentials Dumping in Windows EnvironmentTeymur Kheirkhabarov
 
Windows Threat Hunting
Windows Threat HuntingWindows Threat Hunting
Windows Threat HuntingGIBIN JOHN
 
I hunt sys admins 2.0
I hunt sys admins 2.0I hunt sys admins 2.0
I hunt sys admins 2.0Will Schroeder
 
Catch Me If You Can: PowerShell Red vs Blue
Catch Me If You Can: PowerShell Red vs BlueCatch Me If You Can: PowerShell Red vs Blue
Catch Me If You Can: PowerShell Red vs BlueWill Schroeder
 
SANS Purple Team Summit 2021: Active Directory Purple Team Playbooks
SANS Purple Team Summit 2021: Active Directory Purple Team PlaybooksSANS Purple Team Summit 2021: Active Directory Purple Team Playbooks
SANS Purple Team Summit 2021: Active Directory Purple Team PlaybooksMauricio Velazco
 
PowerShell for Practical Purple Teaming
PowerShell for Practical Purple TeamingPowerShell for Practical Purple Teaming
PowerShell for Practical Purple TeamingNikhil Mittal
 
Hunting for Privilege Escalation in Windows Environment
Hunting for Privilege Escalation in Windows EnvironmentHunting for Privilege Escalation in Windows Environment
Hunting for Privilege Escalation in Windows EnvironmentTeymur Kheirkhabarov
 
How MITRE ATT&CK helps security operations
How MITRE ATT&CK helps security operationsHow MITRE ATT&CK helps security operations
How MITRE ATT&CK helps security operationsSergey Soldatov
 
So you want to be a red teamer
So you want to be a red teamerSo you want to be a red teamer
So you want to be a red teamerJorge Orchilles
 
(Ab)Using GPOs for Active Directory Pwnage
(Ab)Using GPOs for Active Directory Pwnage(Ab)Using GPOs for Active Directory Pwnage
(Ab)Using GPOs for Active Directory PwnagePetros Koutroumpis
 
PHDays 2018 Threat Hunting Hands-On Lab
PHDays 2018 Threat Hunting Hands-On LabPHDays 2018 Threat Hunting Hands-On Lab
PHDays 2018 Threat Hunting Hands-On LabTeymur Kheirkhabarov
 
Client side attacks using PowerShell
Client side attacks using PowerShellClient side attacks using PowerShell
Client side attacks using PowerShellNikhil Mittal
 
ATT&CKing the Red/Blue Divide
ATT&CKing the Red/Blue DivideATT&CKing the Red/Blue Divide
ATT&CKing the Red/Blue DivideMITRE ATT&CK
 
Hunting Lateral Movement in Windows Infrastructure
Hunting Lateral Movement in Windows InfrastructureHunting Lateral Movement in Windows Infrastructure
Hunting Lateral Movement in Windows InfrastructureSergey Soldatov
 
kill-chain-presentation-v3
kill-chain-presentation-v3kill-chain-presentation-v3
kill-chain-presentation-v3Shawn Croswell
 
PSConfEU - Offensive Active Directory (With PowerShell!)
PSConfEU - Offensive Active Directory (With PowerShell!)PSConfEU - Offensive Active Directory (With PowerShell!)
PSConfEU - Offensive Active Directory (With PowerShell!)Will Schroeder
 
MITRE ATT&CKcon 2.0: Lessons in Purple Team Testing with MITRE ATT&CK; Daniel...
MITRE ATT&CKcon 2.0: Lessons in Purple Team Testing with MITRE ATT&CK; Daniel...MITRE ATT&CKcon 2.0: Lessons in Purple Team Testing with MITRE ATT&CK; Daniel...
MITRE ATT&CKcon 2.0: Lessons in Purple Team Testing with MITRE ATT&CK; Daniel...MITRE - ATT&CKcon
 
Knowledge for the masses: Storytelling with ATT&CK
Knowledge for the masses: Storytelling with ATT&CKKnowledge for the masses: Storytelling with ATT&CK
Knowledge for the masses: Storytelling with ATT&CKMITRE ATT&CK
 
Introduction to red team operations
Introduction to red team operationsIntroduction to red team operations
Introduction to red team operationsSunny Neo
 
Purple Team Exercise Hands-On Workshop #GrayHat
Purple Team Exercise Hands-On Workshop #GrayHatPurple Team Exercise Hands-On Workshop #GrayHat
Purple Team Exercise Hands-On Workshop #GrayHatJorge Orchilles
 
The Unintended Risks of Trusting Active Directory
The Unintended Risks of Trusting Active DirectoryThe Unintended Risks of Trusting Active Directory
The Unintended Risks of Trusting Active DirectoryWill Schroeder
 
Forging Trusts for Deception in Active Directory
Forging Trusts for Deception in Active DirectoryForging Trusts for Deception in Active Directory
Forging Trusts for Deception in Active DirectoryNikhil Mittal
 
Cyber Threat hunting workshop
Cyber Threat hunting workshopCyber Threat hunting workshop
Cyber Threat hunting workshopArpan Raval
 
Purple Teaming with ATT&CK - x33fcon 2018
Purple Teaming with ATT&CK - x33fcon 2018Purple Teaming with ATT&CK - x33fcon 2018
Purple Teaming with ATT&CK - x33fcon 2018Christopher Korban
 
Building a Successful Internal Adversarial Simulation Team - Chris Gates & Ch...
Building a Successful Internal Adversarial Simulation Team - Chris Gates & Ch...Building a Successful Internal Adversarial Simulation Team - Chris Gates & Ch...
Building a Successful Internal Adversarial Simulation Team - Chris Gates & Ch...Chris Gates
 
ReCertifying Active Directory
ReCertifying Active DirectoryReCertifying Active Directory
ReCertifying Active DirectoryWill Schroeder
 
Trusts You Might Have Missed
Trusts You Might Have MissedTrusts You Might Have Missed
Trusts You Might Have MissedWill Schroeder
 
The Travelling Pentester: Diaries of the Shortest Path to Compromise
The Travelling Pentester: Diaries of the Shortest Path to CompromiseThe Travelling Pentester: Diaries of the Shortest Path to Compromise
The Travelling Pentester: Diaries of the Shortest Path to CompromiseWill Schroeder
 
I Have the Power(View)
I Have the Power(View)I Have the Power(View)
I Have the Power(View)Will Schroeder
 

More Related Content

What's hot

How MITRE ATT&CK helps security operations
How MITRE ATT&CK helps security operationsHow MITRE ATT&CK helps security operations
How MITRE ATT&CK helps security operationsSergey Soldatov
 
So you want to be a red teamer
So you want to be a red teamerSo you want to be a red teamer
So you want to be a red teamerJorge Orchilles
 
(Ab)Using GPOs for Active Directory Pwnage
(Ab)Using GPOs for Active Directory Pwnage(Ab)Using GPOs for Active Directory Pwnage
(Ab)Using GPOs for Active Directory PwnagePetros Koutroumpis
 
PHDays 2018 Threat Hunting Hands-On Lab
PHDays 2018 Threat Hunting Hands-On LabPHDays 2018 Threat Hunting Hands-On Lab
PHDays 2018 Threat Hunting Hands-On LabTeymur Kheirkhabarov
 
Client side attacks using PowerShell
Client side attacks using PowerShellClient side attacks using PowerShell
Client side attacks using PowerShellNikhil Mittal
 
ATT&CKing the Red/Blue Divide
ATT&CKing the Red/Blue DivideATT&CKing the Red/Blue Divide
ATT&CKing the Red/Blue DivideMITRE ATT&CK
 
Hunting Lateral Movement in Windows Infrastructure
Hunting Lateral Movement in Windows InfrastructureHunting Lateral Movement in Windows Infrastructure
Hunting Lateral Movement in Windows InfrastructureSergey Soldatov
 
kill-chain-presentation-v3
kill-chain-presentation-v3kill-chain-presentation-v3
kill-chain-presentation-v3Shawn Croswell
 
PSConfEU - Offensive Active Directory (With PowerShell!)
PSConfEU - Offensive Active Directory (With PowerShell!)PSConfEU - Offensive Active Directory (With PowerShell!)
PSConfEU - Offensive Active Directory (With PowerShell!)Will Schroeder
 
MITRE ATT&CKcon 2.0: Lessons in Purple Team Testing with MITRE ATT&CK; Daniel...
MITRE ATT&CKcon 2.0: Lessons in Purple Team Testing with MITRE ATT&CK; Daniel...MITRE ATT&CKcon 2.0: Lessons in Purple Team Testing with MITRE ATT&CK; Daniel...
MITRE ATT&CKcon 2.0: Lessons in Purple Team Testing with MITRE ATT&CK; Daniel...MITRE - ATT&CKcon
 
Knowledge for the masses: Storytelling with ATT&CK
Knowledge for the masses: Storytelling with ATT&CKKnowledge for the masses: Storytelling with ATT&CK
Knowledge for the masses: Storytelling with ATT&CKMITRE ATT&CK
 
Introduction to red team operations
Introduction to red team operationsIntroduction to red team operations
Introduction to red team operationsSunny Neo
 
Purple Team Exercise Hands-On Workshop #GrayHat
Purple Team Exercise Hands-On Workshop #GrayHatPurple Team Exercise Hands-On Workshop #GrayHat
Purple Team Exercise Hands-On Workshop #GrayHatJorge Orchilles
 
The Unintended Risks of Trusting Active Directory
The Unintended Risks of Trusting Active DirectoryThe Unintended Risks of Trusting Active Directory
The Unintended Risks of Trusting Active DirectoryWill Schroeder
 
Forging Trusts for Deception in Active Directory
Forging Trusts for Deception in Active DirectoryForging Trusts for Deception in Active Directory
Forging Trusts for Deception in Active DirectoryNikhil Mittal
 
Cyber Threat hunting workshop
Cyber Threat hunting workshopCyber Threat hunting workshop
Cyber Threat hunting workshopArpan Raval
 
Purple Teaming with ATT&CK - x33fcon 2018
Purple Teaming with ATT&CK - x33fcon 2018Purple Teaming with ATT&CK - x33fcon 2018
Purple Teaming with ATT&CK - x33fcon 2018Christopher Korban
 
Building a Successful Internal Adversarial Simulation Team - Chris Gates & Ch...
Building a Successful Internal Adversarial Simulation Team - Chris Gates & Ch...Building a Successful Internal Adversarial Simulation Team - Chris Gates & Ch...
Building a Successful Internal Adversarial Simulation Team - Chris Gates & Ch...Chris Gates
 
ReCertifying Active Directory
ReCertifying Active DirectoryReCertifying Active Directory
ReCertifying Active DirectoryWill Schroeder
 
Trusts You Might Have Missed
Trusts You Might Have MissedTrusts You Might Have Missed
Trusts You Might Have MissedWill Schroeder
 

What's hot (20)

How MITRE ATT&CK helps security operations
How MITRE ATT&CK helps security operationsHow MITRE ATT&CK helps security operations
How MITRE ATT&CK helps security operations
 
So you want to be a red teamer
So you want to be a red teamerSo you want to be a red teamer
So you want to be a red teamer
 
(Ab)Using GPOs for Active Directory Pwnage
(Ab)Using GPOs for Active Directory Pwnage(Ab)Using GPOs for Active Directory Pwnage
(Ab)Using GPOs for Active Directory Pwnage
 
PHDays 2018 Threat Hunting Hands-On Lab
PHDays 2018 Threat Hunting Hands-On LabPHDays 2018 Threat Hunting Hands-On Lab
PHDays 2018 Threat Hunting Hands-On Lab
 
Client side attacks using PowerShell
Client side attacks using PowerShellClient side attacks using PowerShell
Client side attacks using PowerShell
 
ATT&CKing the Red/Blue Divide
ATT&CKing the Red/Blue DivideATT&CKing the Red/Blue Divide
ATT&CKing the Red/Blue Divide
 
Hunting Lateral Movement in Windows Infrastructure
Hunting Lateral Movement in Windows InfrastructureHunting Lateral Movement in Windows Infrastructure
Hunting Lateral Movement in Windows Infrastructure
 
kill-chain-presentation-v3
kill-chain-presentation-v3kill-chain-presentation-v3
kill-chain-presentation-v3
 
PSConfEU - Offensive Active Directory (With PowerShell!)
PSConfEU - Offensive Active Directory (With PowerShell!)PSConfEU - Offensive Active Directory (With PowerShell!)
PSConfEU - Offensive Active Directory (With PowerShell!)
 
MITRE ATT&CKcon 2.0: Lessons in Purple Team Testing with MITRE ATT&CK; Daniel...
MITRE ATT&CKcon 2.0: Lessons in Purple Team Testing with MITRE ATT&CK; Daniel...MITRE ATT&CKcon 2.0: Lessons in Purple Team Testing with MITRE ATT&CK; Daniel...
MITRE ATT&CKcon 2.0: Lessons in Purple Team Testing with MITRE ATT&CK; Daniel...
 
Knowledge for the masses: Storytelling with ATT&CK
Knowledge for the masses: Storytelling with ATT&CKKnowledge for the masses: Storytelling with ATT&CK
Knowledge for the masses: Storytelling with ATT&CK
 
Introduction to red team operations
Introduction to red team operationsIntroduction to red team operations
Introduction to red team operations
 
Purple Team Exercise Hands-On Workshop #GrayHat
Purple Team Exercise Hands-On Workshop #GrayHatPurple Team Exercise Hands-On Workshop #GrayHat
Purple Team Exercise Hands-On Workshop #GrayHat
 
The Unintended Risks of Trusting Active Directory
The Unintended Risks of Trusting Active DirectoryThe Unintended Risks of Trusting Active Directory
The Unintended Risks of Trusting Active Directory
 
Forging Trusts for Deception in Active Directory
Forging Trusts for Deception in Active DirectoryForging Trusts for Deception in Active Directory
Forging Trusts for Deception in Active Directory
 
Cyber Threat hunting workshop
Cyber Threat hunting workshopCyber Threat hunting workshop
Cyber Threat hunting workshop
 
Purple Teaming with ATT&CK - x33fcon 2018
Purple Teaming with ATT&CK - x33fcon 2018Purple Teaming with ATT&CK - x33fcon 2018
Purple Teaming with ATT&CK - x33fcon 2018
 
Building a Successful Internal Adversarial Simulation Team - Chris Gates & Ch...
Building a Successful Internal Adversarial Simulation Team - Chris Gates & Ch...Building a Successful Internal Adversarial Simulation Team - Chris Gates & Ch...
Building a Successful Internal Adversarial Simulation Team - Chris Gates & Ch...
 
ReCertifying Active Directory
ReCertifying Active DirectoryReCertifying Active Directory
ReCertifying Active Directory
 
Trusts You Might Have Missed
Trusts You Might Have MissedTrusts You Might Have Missed
Trusts You Might Have Missed
 

Viewers also liked

The Travelling Pentester: Diaries of the Shortest Path to Compromise
The Travelling Pentester: Diaries of the Shortest Path to CompromiseThe Travelling Pentester: Diaries of the Shortest Path to Compromise
The Travelling Pentester: Diaries of the Shortest Path to CompromiseWill Schroeder
 
I Have the Power(View)
I Have the Power(View)I Have the Power(View)
I Have the Power(View)Will Schroeder
 
Sccm 2012
Sccm 2012Sccm 2012
Sccm 2012ebuc
 
Red team upgrades using sccm for malware deployment
Red team upgrades using sccm for malware deploymentRed team upgrades using sccm for malware deployment
Red team upgrades using sccm for malware deploymentenigma0x3
 
Attack All the Layers: What's Working during Pentests (OWASP NYC)
Attack All the Layers: What's Working during Pentests (OWASP NYC)Attack All the Layers: What's Working during Pentests (OWASP NYC)
Attack All the Layers: What's Working during Pentests (OWASP NYC)Scott Sutherland
 
Bridging the Gap: Lessons in Adversarial Tradecraft
Bridging the Gap: Lessons in Adversarial TradecraftBridging the Gap: Lessons in Adversarial Tradecraft
Bridging the Gap: Lessons in Adversarial Tradecraftenigma0x3
 
2016 aRcTicCON - Hacking SQL Server on Scale with PowerShell (Slide Updates)
2016 aRcTicCON - Hacking SQL Server on Scale with PowerShell (Slide Updates)2016 aRcTicCON - Hacking SQL Server on Scale with PowerShell (Slide Updates)
2016 aRcTicCON - Hacking SQL Server on Scale with PowerShell (Slide Updates)Scott Sutherland
 
DerbyCon2016 - Hacking SQL Server on Scale with PowerShell
DerbyCon2016 - Hacking SQL Server on Scale with PowerShellDerbyCon2016 - Hacking SQL Server on Scale with PowerShell
DerbyCon2016 - Hacking SQL Server on Scale with PowerShellScott Sutherland
 
PSConfEU - Building an Empire with PowerShell
PSConfEU - Building an Empire with PowerShellPSConfEU - Building an Empire with PowerShell
PSConfEU - Building an Empire with PowerShellWill Schroeder
 
Lares from LOW to PWNED
Lares from LOW to PWNEDLares from LOW to PWNED
Lares from LOW to PWNEDChris Gates
 
System Center 2012 R2 - Enterprise Automation
System Center 2012 R2 - Enterprise AutomationSystem Center 2012 R2 - Enterprise Automation
System Center 2012 R2 - Enterprise AutomationScientia Groups
 
What's New in System Center 2012
What's New in System Center 2012 What's New in System Center 2012
What's New in System Center 2012 Perficient, Inc.
 
System Center Configuration Manager 2012 Sneak Peek
System Center Configuration Manager 2012 Sneak PeekSystem Center Configuration Manager 2012 Sneak Peek
System Center Configuration Manager 2012 Sneak PeekC/D/H Technology Consultants
 
World Population Datasheet 2008
World Population Datasheet 2008World Population Datasheet 2008
World Population Datasheet 2008richm711
 
ITCamp 2011 - Adrian Stoian - System Center Configuration Manager 2012
ITCamp 2011 - Adrian Stoian - System Center Configuration Manager 2012ITCamp 2011 - Adrian Stoian - System Center Configuration Manager 2012
ITCamp 2011 - Adrian Stoian - System Center Configuration Manager 2012ITCamp
 
Microsoft system center 2012 r2 configuration manager
Microsoft system center 2012 r2 configuration managerMicrosoft system center 2012 r2 configuration manager
Microsoft system center 2012 r2 configuration managerapponix1
 
Using SCUP (System Center Updates Publisher) to Security Patch 3rd Party Apps...
Using SCUP (System Center Updates Publisher) to Security Patch 3rd Party Apps...Using SCUP (System Center Updates Publisher) to Security Patch 3rd Party Apps...
Using SCUP (System Center Updates Publisher) to Security Patch 3rd Party Apps...Lumension
 
IT/Dev Connections: Intune, ConfigMgr, or Both: Choose the Right Tool for the...
IT/Dev Connections: Intune, ConfigMgr, or Both: Choose the Right Tool for the...IT/Dev Connections: Intune, ConfigMgr, or Both: Choose the Right Tool for the...
IT/Dev Connections: Intune, ConfigMgr, or Both: Choose the Right Tool for the...Peter Daalmans
 

Viewers also liked (20)

The Travelling Pentester: Diaries of the Shortest Path to Compromise
The Travelling Pentester: Diaries of the Shortest Path to CompromiseThe Travelling Pentester: Diaries of the Shortest Path to Compromise
The Travelling Pentester: Diaries of the Shortest Path to Compromise
 
I Have the Power(View)
I Have the Power(View)I Have the Power(View)
I Have the Power(View)
 
Sccm 2012
Sccm 2012Sccm 2012
Sccm 2012
 
Red team upgrades using sccm for malware deployment
Red team upgrades using sccm for malware deploymentRed team upgrades using sccm for malware deployment
Red team upgrades using sccm for malware deployment
 
Attack All the Layers: What's Working during Pentests (OWASP NYC)
Attack All the Layers: What's Working during Pentests (OWASP NYC)Attack All the Layers: What's Working during Pentests (OWASP NYC)
Attack All the Layers: What's Working during Pentests (OWASP NYC)
 
Bridging the Gap: Lessons in Adversarial Tradecraft
Bridging the Gap: Lessons in Adversarial TradecraftBridging the Gap: Lessons in Adversarial Tradecraft
Bridging the Gap: Lessons in Adversarial Tradecraft
 
2016 aRcTicCON - Hacking SQL Server on Scale with PowerShell (Slide Updates)
2016 aRcTicCON - Hacking SQL Server on Scale with PowerShell (Slide Updates)2016 aRcTicCON - Hacking SQL Server on Scale with PowerShell (Slide Updates)
2016 aRcTicCON - Hacking SQL Server on Scale with PowerShell (Slide Updates)
 
DerbyCon2016 - Hacking SQL Server on Scale with PowerShell
DerbyCon2016 - Hacking SQL Server on Scale with PowerShellDerbyCon2016 - Hacking SQL Server on Scale with PowerShell
DerbyCon2016 - Hacking SQL Server on Scale with PowerShell
 
PSConfEU - Building an Empire with PowerShell
PSConfEU - Building an Empire with PowerShellPSConfEU - Building an Empire with PowerShell
PSConfEU - Building an Empire with PowerShell
 
Lares from LOW to PWNED
Lares from LOW to PWNEDLares from LOW to PWNED
Lares from LOW to PWNED
 
Bridging the Gap
Bridging the GapBridging the Gap
Bridging the Gap
 
System Center 2012 R2 - Enterprise Automation
System Center 2012 R2 - Enterprise AutomationSystem Center 2012 R2 - Enterprise Automation
System Center 2012 R2 - Enterprise Automation
 
What's New in System Center 2012
What's New in System Center 2012 What's New in System Center 2012
What's New in System Center 2012
 
System Center Configuration Manager 2012 Sneak Peek
System Center Configuration Manager 2012 Sneak PeekSystem Center Configuration Manager 2012 Sneak Peek
System Center Configuration Manager 2012 Sneak Peek
 
Ultima 14th March
Ultima 14th MarchUltima 14th March
Ultima 14th March
 
World Population Datasheet 2008
World Population Datasheet 2008World Population Datasheet 2008
World Population Datasheet 2008
 
ITCamp 2011 - Adrian Stoian - System Center Configuration Manager 2012
ITCamp 2011 - Adrian Stoian - System Center Configuration Manager 2012ITCamp 2011 - Adrian Stoian - System Center Configuration Manager 2012
ITCamp 2011 - Adrian Stoian - System Center Configuration Manager 2012
 
Microsoft system center 2012 r2 configuration manager
Microsoft system center 2012 r2 configuration managerMicrosoft system center 2012 r2 configuration manager
Microsoft system center 2012 r2 configuration manager
 
Using SCUP (System Center Updates Publisher) to Security Patch 3rd Party Apps...
Using SCUP (System Center Updates Publisher) to Security Patch 3rd Party Apps...Using SCUP (System Center Updates Publisher) to Security Patch 3rd Party Apps...
Using SCUP (System Center Updates Publisher) to Security Patch 3rd Party Apps...
 
IT/Dev Connections: Intune, ConfigMgr, or Both: Choose the Right Tool for the...
IT/Dev Connections: Intune, ConfigMgr, or Both: Choose the Right Tool for the...IT/Dev Connections: Intune, ConfigMgr, or Both: Choose the Right Tool for the...
IT/Dev Connections: Intune, ConfigMgr, or Both: Choose the Right Tool for the...
 

Similar to Using SCCM to Spread Malware

Cloudsim_openstack_aws_lastunit_bsccs_cloud computing
Cloudsim_openstack_aws_lastunit_bsccs_cloud computingCloudsim_openstack_aws_lastunit_bsccs_cloud computing
Cloudsim_openstack_aws_lastunit_bsccs_cloud computingMrSameerSTathare
 
Go Hack Yourself - 10 Pen Test Tactics for Blue Teamers
Go Hack Yourself - 10 Pen Test Tactics for Blue TeamersGo Hack Yourself - 10 Pen Test Tactics for Blue Teamers
Go Hack Yourself - 10 Pen Test Tactics for Blue Teamersjasonjfrank
 
Mitre Attack - Credential Dumping - updated.pptx
Mitre Attack - Credential Dumping - updated.pptxMitre Attack - Credential Dumping - updated.pptx
Mitre Attack - Credential Dumping - updated.pptxwaizuq
 
How to measure your security response readiness?
How to measure your security response readiness?How to measure your security response readiness?
How to measure your security response readiness?Tomasz Jakubowski
 
IANS information security forum 2019 summary
IANS information security forum 2019 summaryIANS information security forum 2019 summary
IANS information security forum 2019 summaryKarun Chennuri
 
PSU Security Conference 2015 - LAPS Presentation
PSU Security Conference 2015 - LAPS PresentationPSU Security Conference 2015 - LAPS Presentation
PSU Security Conference 2015 - LAPS PresentationDan Barr
 
Introduction to Adversary Evaluation Tools
Introduction to Adversary Evaluation ToolsIntroduction to Adversary Evaluation Tools
Introduction to Adversary Evaluation ToolsAj MaChInE
 
SCCM 2007 Introduction - PICC 2012
SCCM 2007 Introduction - PICC 2012SCCM 2007 Introduction - PICC 2012
SCCM 2007 Introduction - PICC 2012capriguy84
 
Openstack Cloud Management and Automation Using Red Hat Cloudforms 4.0
Openstack Cloud Management and Automation Using Red Hat Cloudforms 4.0Openstack Cloud Management and Automation Using Red Hat Cloudforms 4.0
Openstack Cloud Management and Automation Using Red Hat Cloudforms 4.0Prasad Mukhedkar
 
The Great Disconnect of Data Protection: Perception, Reality and Best Practices
The Great Disconnect of Data Protection: Perception, Reality and Best PracticesThe Great Disconnect of Data Protection: Perception, Reality and Best Practices
The Great Disconnect of Data Protection: Perception, Reality and Best Practicesiland Cloud
 
Tips to Remediate your Vulnerability Management Program
Tips to Remediate your Vulnerability Management ProgramTips to Remediate your Vulnerability Management Program
Tips to Remediate your Vulnerability Management ProgramBeyondTrust
 
rsa-usa-2019-keynote-paula-januszkiewicz
rsa-usa-2019-keynote-paula-januszkiewiczrsa-usa-2019-keynote-paula-januszkiewicz
rsa-usa-2019-keynote-paula-januszkiewiczPaula Januszkiewicz
 
MS Just Gave the Blue Team Tactical Nukes (And How Red Teams Need To Adapt) -...
MS Just Gave the Blue Team Tactical Nukes (And How Red Teams Need To Adapt) -...MS Just Gave the Blue Team Tactical Nukes (And How Red Teams Need To Adapt) -...
MS Just Gave the Blue Team Tactical Nukes (And How Red Teams Need To Adapt) -...Chris Thompson
 
Build your first DApp using Substrate Framework - Part I
Build your first DApp using Substrate Framework - Part IBuild your first DApp using Substrate Framework - Part I
Build your first DApp using Substrate Framework - Part IKnoldus Inc.
 
The Ultimate Guide to Docker & Kubernetes Forensics and Incident Response.pdf
The Ultimate Guide to Docker & Kubernetes Forensics and Incident Response.pdfThe Ultimate Guide to Docker & Kubernetes Forensics and Incident Response.pdf
The Ultimate Guide to Docker & Kubernetes Forensics and Incident Response.pdfChristopher Doman
 
Hyper-V: Best Practices
Hyper-V: Best PracticesHyper-V: Best Practices
Hyper-V: Best PracticesTomica Kaniski
 
VMworld 2013: Introducing NSX Service Composer: The New Consumption Model for...
VMworld 2013: Introducing NSX Service Composer: The New Consumption Model for...VMworld 2013: Introducing NSX Service Composer: The New Consumption Model for...
VMworld 2013: Introducing NSX Service Composer: The New Consumption Model for...VMworld
 
Chris Rutter: Avoiding The Security Brick
Chris Rutter: Avoiding The Security BrickChris Rutter: Avoiding The Security Brick
Chris Rutter: Avoiding The Security BrickMichael Man
 
Ever Present Persistence - Established Footholds Seen in the Wild
Ever Present Persistence - Established Footholds Seen in the WildEver Present Persistence - Established Footholds Seen in the Wild
Ever Present Persistence - Established Footholds Seen in the WildCTruncer
 

Similar to Using SCCM to Spread Malware (20)

Cloudsim_openstack_aws_lastunit_bsccs_cloud computing
Cloudsim_openstack_aws_lastunit_bsccs_cloud computingCloudsim_openstack_aws_lastunit_bsccs_cloud computing
Cloudsim_openstack_aws_lastunit_bsccs_cloud computing
 
Go Hack Yourself - 10 Pen Test Tactics for Blue Teamers
Go Hack Yourself - 10 Pen Test Tactics for Blue TeamersGo Hack Yourself - 10 Pen Test Tactics for Blue Teamers
Go Hack Yourself - 10 Pen Test Tactics for Blue Teamers
 
Mitre Attack - Credential Dumping - updated.pptx
Mitre Attack - Credential Dumping - updated.pptxMitre Attack - Credential Dumping - updated.pptx
Mitre Attack - Credential Dumping - updated.pptx
 
Breach and attack simulation tools
Breach and attack simulation toolsBreach and attack simulation tools
Breach and attack simulation tools
 
How to measure your security response readiness?
How to measure your security response readiness?How to measure your security response readiness?
How to measure your security response readiness?
 
IANS information security forum 2019 summary
IANS information security forum 2019 summaryIANS information security forum 2019 summary
IANS information security forum 2019 summary
 
PSU Security Conference 2015 - LAPS Presentation
PSU Security Conference 2015 - LAPS PresentationPSU Security Conference 2015 - LAPS Presentation
PSU Security Conference 2015 - LAPS Presentation
 
Introduction to Adversary Evaluation Tools
Introduction to Adversary Evaluation ToolsIntroduction to Adversary Evaluation Tools
Introduction to Adversary Evaluation Tools
 
SCCM 2007 Introduction - PICC 2012
SCCM 2007 Introduction - PICC 2012SCCM 2007 Introduction - PICC 2012
SCCM 2007 Introduction - PICC 2012
 
Openstack Cloud Management and Automation Using Red Hat Cloudforms 4.0
Openstack Cloud Management and Automation Using Red Hat Cloudforms 4.0Openstack Cloud Management and Automation Using Red Hat Cloudforms 4.0
Openstack Cloud Management and Automation Using Red Hat Cloudforms 4.0
 
The Great Disconnect of Data Protection: Perception, Reality and Best Practices
The Great Disconnect of Data Protection: Perception, Reality and Best PracticesThe Great Disconnect of Data Protection: Perception, Reality and Best Practices
The Great Disconnect of Data Protection: Perception, Reality and Best Practices
 
Tips to Remediate your Vulnerability Management Program
Tips to Remediate your Vulnerability Management ProgramTips to Remediate your Vulnerability Management Program
Tips to Remediate your Vulnerability Management Program
 
rsa-usa-2019-keynote-paula-januszkiewicz
rsa-usa-2019-keynote-paula-januszkiewiczrsa-usa-2019-keynote-paula-januszkiewicz
rsa-usa-2019-keynote-paula-januszkiewicz
 
MS Just Gave the Blue Team Tactical Nukes (And How Red Teams Need To Adapt) -...
MS Just Gave the Blue Team Tactical Nukes (And How Red Teams Need To Adapt) -...MS Just Gave the Blue Team Tactical Nukes (And How Red Teams Need To Adapt) -...
MS Just Gave the Blue Team Tactical Nukes (And How Red Teams Need To Adapt) -...
 
Build your first DApp using Substrate Framework - Part I
Build your first DApp using Substrate Framework - Part IBuild your first DApp using Substrate Framework - Part I
Build your first DApp using Substrate Framework - Part I
 
The Ultimate Guide to Docker & Kubernetes Forensics and Incident Response.pdf
The Ultimate Guide to Docker & Kubernetes Forensics and Incident Response.pdfThe Ultimate Guide to Docker & Kubernetes Forensics and Incident Response.pdf
The Ultimate Guide to Docker & Kubernetes Forensics and Incident Response.pdf
 
Hyper-V: Best Practices
Hyper-V: Best PracticesHyper-V: Best Practices
Hyper-V: Best Practices
 
VMworld 2013: Introducing NSX Service Composer: The New Consumption Model for...
VMworld 2013: Introducing NSX Service Composer: The New Consumption Model for...VMworld 2013: Introducing NSX Service Composer: The New Consumption Model for...
VMworld 2013: Introducing NSX Service Composer: The New Consumption Model for...
 
Chris Rutter: Avoiding The Security Brick
Chris Rutter: Avoiding The Security BrickChris Rutter: Avoiding The Security Brick
Chris Rutter: Avoiding The Security Brick
 
Ever Present Persistence - Established Footholds Seen in the Wild
Ever Present Persistence - Established Footholds Seen in the WildEver Present Persistence - Established Footholds Seen in the Wild
Ever Present Persistence - Established Footholds Seen in the Wild
 

Recently uploaded

Kalyanpur ) Call Girls in Lucknow Finest Escorts Service 🍸 8923113531 🎰 Avail...
Kalyanpur ) Call Girls in Lucknow Finest Escorts Service 🍸 8923113531 🎰 Avail...Kalyanpur ) Call Girls in Lucknow Finest Escorts Service 🍸 8923113531 🎰 Avail...
Kalyanpur ) Call Girls in Lucknow Finest Escorts Service 🍸 8923113531 🎰 Avail...gurkirankumar98700
 
A Domino Admins Adventures (Engage 2024)
A Domino Admins Adventures (Engage 2024)A Domino Admins Adventures (Engage 2024)
A Domino Admins Adventures (Engage 2024)Gabriella Davis
 
My Hashitalk Indonesia April 2024 Presentation
My Hashitalk Indonesia April 2024 PresentationMy Hashitalk Indonesia April 2024 Presentation
My Hashitalk Indonesia April 2024 PresentationRidwan Fadjar
 
The Codex of Business Writing Software for Real-World Solutions 2.pptx
The Codex of Business Writing Software for Real-World Solutions 2.pptxThe Codex of Business Writing Software for Real-World Solutions 2.pptx
The Codex of Business Writing Software for Real-World Solutions 2.pptxMalak Abu Hammad
 
Raspberry Pi 5: Challenges and Solutions in Bringing up an OpenGL/Vulkan Driv...
Raspberry Pi 5: Challenges and Solutions in Bringing up an OpenGL/Vulkan Driv...Raspberry Pi 5: Challenges and Solutions in Bringing up an OpenGL/Vulkan Driv...
Raspberry Pi 5: Challenges and Solutions in Bringing up an OpenGL/Vulkan Driv...Igalia
 
Slack Application Development 101 Slides
Slack Application Development 101 SlidesSlack Application Development 101 Slides
Slack Application Development 101 Slidespraypatel2
 
Presentation on how to chat with PDF using ChatGPT code interpreter
Presentation on how to chat with PDF using ChatGPT code interpreterPresentation on how to chat with PDF using ChatGPT code interpreter
Presentation on how to chat with PDF using ChatGPT code interpreternaman860154
 
Finology Group – Insurtech Innovation Award 2024
Finology Group – Insurtech Innovation Award 2024Finology Group – Insurtech Innovation Award 2024
Finology Group – Insurtech Innovation Award 2024The Digital Insurer
 
From Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time AutomationFrom Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time AutomationSafe Software
 
WhatsApp 9892124323 ✓Call Girls In Kalyan ( Mumbai ) secure service
WhatsApp 9892124323 ✓Call Girls In Kalyan ( Mumbai ) secure serviceWhatsApp 9892124323 ✓Call Girls In Kalyan ( Mumbai ) secure service
WhatsApp 9892124323 ✓Call Girls In Kalyan ( Mumbai ) secure servicePooja Nehwal
 
[2024]Digital Global Overview Report 2024 Meltwater.pdf
[2024]Digital Global Overview Report 2024 Meltwater.pdf[2024]Digital Global Overview Report 2024 Meltwater.pdf
[2024]Digital Global Overview Report 2024 Meltwater.pdfhans926745
 
Transforming Data Streams with Kafka Connect: An Introduction to Single Messa...
Transforming Data Streams with Kafka Connect: An Introduction to Single Messa...Transforming Data Streams with Kafka Connect: An Introduction to Single Messa...
Transforming Data Streams with Kafka Connect: An Introduction to Single Messa...HostedbyConfluent
 
08448380779 Call Girls In Civil Lines Women Seeking Men
08448380779 Call Girls In Civil Lines Women Seeking Men08448380779 Call Girls In Civil Lines Women Seeking Men
08448380779 Call Girls In Civil Lines Women Seeking MenDelhi Call girls
 
Injustice - Developers Among Us (SciFiDevCon 2024)
Injustice - Developers Among Us (SciFiDevCon 2024)Injustice - Developers Among Us (SciFiDevCon 2024)
Injustice - Developers Among Us (SciFiDevCon 2024)Allon Mureinik
 
FULL ENJOY 🔝 8264348440 🔝 Call Girls in Diplomatic Enclave | Delhi
FULL ENJOY 🔝 8264348440 🔝 Call Girls in Diplomatic Enclave | DelhiFULL ENJOY 🔝 8264348440 🔝 Call Girls in Diplomatic Enclave | Delhi
FULL ENJOY 🔝 8264348440 🔝 Call Girls in Diplomatic Enclave | Delhisoniya singh
 
Unblocking The Main Thread Solving ANRs and Frozen Frames
Unblocking The Main Thread Solving ANRs and Frozen FramesUnblocking The Main Thread Solving ANRs and Frozen Frames
Unblocking The Main Thread Solving ANRs and Frozen FramesSinan KOZAK
 
08448380779 Call Girls In Diplomatic Enclave Women Seeking Men
08448380779 Call Girls In Diplomatic Enclave Women Seeking Men08448380779 Call Girls In Diplomatic Enclave Women Seeking Men
08448380779 Call Girls In Diplomatic Enclave Women Seeking MenDelhi Call girls
 
CNv6 Instructor Chapter 6 Quality of Service
CNv6 Instructor Chapter 6 Quality of ServiceCNv6 Instructor Chapter 6 Quality of Service
CNv6 Instructor Chapter 6 Quality of Servicegiselly40
 
Enhancing Worker Digital Experience: A Hands-on Workshop for Partners
Enhancing Worker Digital Experience: A Hands-on Workshop for PartnersEnhancing Worker Digital Experience: A Hands-on Workshop for Partners
Enhancing Worker Digital Experience: A Hands-on Workshop for PartnersThousandEyes
 
Handwritten Text Recognition for manuscripts and early printed texts
Handwritten Text Recognition for manuscripts and early printed textsHandwritten Text Recognition for manuscripts and early printed texts
Handwritten Text Recognition for manuscripts and early printed textsMaria Levchenko
 

Recently uploaded (20)

Kalyanpur ) Call Girls in Lucknow Finest Escorts Service 🍸 8923113531 🎰 Avail...
Kalyanpur ) Call Girls in Lucknow Finest Escorts Service 🍸 8923113531 🎰 Avail...Kalyanpur ) Call Girls in Lucknow Finest Escorts Service 🍸 8923113531 🎰 Avail...
Kalyanpur ) Call Girls in Lucknow Finest Escorts Service 🍸 8923113531 🎰 Avail...
 
A Domino Admins Adventures (Engage 2024)
A Domino Admins Adventures (Engage 2024)A Domino Admins Adventures (Engage 2024)
A Domino Admins Adventures (Engage 2024)
 
My Hashitalk Indonesia April 2024 Presentation
My Hashitalk Indonesia April 2024 PresentationMy Hashitalk Indonesia April 2024 Presentation
My Hashitalk Indonesia April 2024 Presentation
 
The Codex of Business Writing Software for Real-World Solutions 2.pptx
The Codex of Business Writing Software for Real-World Solutions 2.pptxThe Codex of Business Writing Software for Real-World Solutions 2.pptx
The Codex of Business Writing Software for Real-World Solutions 2.pptx
 
Raspberry Pi 5: Challenges and Solutions in Bringing up an OpenGL/Vulkan Driv...
Raspberry Pi 5: Challenges and Solutions in Bringing up an OpenGL/Vulkan Driv...Raspberry Pi 5: Challenges and Solutions in Bringing up an OpenGL/Vulkan Driv...
Raspberry Pi 5: Challenges and Solutions in Bringing up an OpenGL/Vulkan Driv...
 
Slack Application Development 101 Slides
Slack Application Development 101 SlidesSlack Application Development 101 Slides
Slack Application Development 101 Slides
 
Presentation on how to chat with PDF using ChatGPT code interpreter
Presentation on how to chat with PDF using ChatGPT code interpreterPresentation on how to chat with PDF using ChatGPT code interpreter
Presentation on how to chat with PDF using ChatGPT code interpreter
 
Finology Group – Insurtech Innovation Award 2024
Finology Group – Insurtech Innovation Award 2024Finology Group – Insurtech Innovation Award 2024
Finology Group – Insurtech Innovation Award 2024
 
From Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time AutomationFrom Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time Automation
 
WhatsApp 9892124323 ✓Call Girls In Kalyan ( Mumbai ) secure service
WhatsApp 9892124323 ✓Call Girls In Kalyan ( Mumbai ) secure serviceWhatsApp 9892124323 ✓Call Girls In Kalyan ( Mumbai ) secure service
WhatsApp 9892124323 ✓Call Girls In Kalyan ( Mumbai ) secure service
 
[2024]Digital Global Overview Report 2024 Meltwater.pdf
[2024]Digital Global Overview Report 2024 Meltwater.pdf[2024]Digital Global Overview Report 2024 Meltwater.pdf
[2024]Digital Global Overview Report 2024 Meltwater.pdf
 
Transforming Data Streams with Kafka Connect: An Introduction to Single Messa...
Transforming Data Streams with Kafka Connect: An Introduction to Single Messa...Transforming Data Streams with Kafka Connect: An Introduction to Single Messa...
Transforming Data Streams with Kafka Connect: An Introduction to Single Messa...
 
08448380779 Call Girls In Civil Lines Women Seeking Men
08448380779 Call Girls In Civil Lines Women Seeking Men08448380779 Call Girls In Civil Lines Women Seeking Men
08448380779 Call Girls In Civil Lines Women Seeking Men
 
Injustice - Developers Among Us (SciFiDevCon 2024)
Injustice - Developers Among Us (SciFiDevCon 2024)Injustice - Developers Among Us (SciFiDevCon 2024)
Injustice - Developers Among Us (SciFiDevCon 2024)
 
FULL ENJOY 🔝 8264348440 🔝 Call Girls in Diplomatic Enclave | Delhi
FULL ENJOY 🔝 8264348440 🔝 Call Girls in Diplomatic Enclave | DelhiFULL ENJOY 🔝 8264348440 🔝 Call Girls in Diplomatic Enclave | Delhi
FULL ENJOY 🔝 8264348440 🔝 Call Girls in Diplomatic Enclave | Delhi
 
Unblocking The Main Thread Solving ANRs and Frozen Frames
Unblocking The Main Thread Solving ANRs and Frozen FramesUnblocking The Main Thread Solving ANRs and Frozen Frames
Unblocking The Main Thread Solving ANRs and Frozen Frames
 
08448380779 Call Girls In Diplomatic Enclave Women Seeking Men
08448380779 Call Girls In Diplomatic Enclave Women Seeking Men08448380779 Call Girls In Diplomatic Enclave Women Seeking Men
08448380779 Call Girls In Diplomatic Enclave Women Seeking Men
 
CNv6 Instructor Chapter 6 Quality of Service
CNv6 Instructor Chapter 6 Quality of ServiceCNv6 Instructor Chapter 6 Quality of Service
CNv6 Instructor Chapter 6 Quality of Service
 
Enhancing Worker Digital Experience: A Hands-on Workshop for Partners
Enhancing Worker Digital Experience: A Hands-on Workshop for PartnersEnhancing Worker Digital Experience: A Hands-on Workshop for Partners
Enhancing Worker Digital Experience: A Hands-on Workshop for Partners
 
Handwritten Text Recognition for manuscripts and early printed texts
Handwritten Text Recognition for manuscripts and early printed textsHandwritten Text Recognition for manuscripts and early printed texts
Handwritten Text Recognition for manuscripts and early printed texts
 

Using SCCM to Spread Malware

  • 1. Up is Down, Black is White: Using SCCM for Wrong and Right Matt Nelson, Will Schroeder Veris Group’s Adaptive Threat Division
  • 2. @enigma0x3 ❖ Penetration Tester and Red Teamer for the Adaptive Threat Division (ATD) of Veris Group ❖ Active developer on the PowerShell Empire project ❖ Offensive PowerShell advocate ❖ Sysadmin while in college ❖ Cons: Shmoocon (Firetalks), BSides DC
  • 3. @harmj0y ❖ Security researcher and red teamer for the Adaptive Threat Division of Veris Group ❖ Co-founder and active developer of the Veil- Framework | PowerTools | Empire ❖ PowerSploit developer ❖ Microsoft CDM/PowerShell MVP ❖ Cons: Shmoocon, DEF CON, DerbyCon, various BSides (including BSides Boston!)
  • 4. tl;dr ● Background ○ Red Teaming vs. Pentesting ○ Hunting vs. Incident Response ○ Basics of SCCM ○ SCCM in the enterprise ● Using and Abusing SCCM ○ SCCM as an attack platform ○ Introducing PowerSCCM ○ Using PowerSCCM for Evil ○ Using PowerSCCM for Good ○ Demo
  • 5. Background Pentesting vs Red Teaming Hunting vs Incident Response
  • 6. Pentesting ● Pentesting doesn’t have a universal definition ● Could be: ○ A single person running a (slightly) glorified vuln scan ○ A few testers for 1-2 weeks ○ A multi-week assault with a large team ● We view pentesting as focused on breadth- find as many holes as possible and see how far you can get in a limited timeframe with open source tools
  • 7. Our View of Red Teaming ● We view a red team engagement as an opportunity to test an organization’s incident response capabilities ○ We don’t remove logs ○ Ideally, parts of the engagement are ‘caught’ and others aren’t ○ We want to find a client’s ‘noise’ threshold ● General idea: simulate a reasonably “advanced” generic attacker, not a specific adversary
  • 8. Incident Response ● “Five alarm fire” concept ● Kicked off by: ○ Network monitoring alerts ○ Third party service notification ○ Public breach/disclosure ● Reactive, by the time you notice something went wrong it’s often too late
  • 9. Hunting ● US Department of Defense concept ● The blue version of the “assume breach” mentality ● Detection, Investigation, Response ○ Deny, Degrade, Disrupt, Manipulate ● Much more proactive ○ Assume you’re owned, search for evidence of compromise
  • 10. “Fundamentally, if somebody wants to get in, they're getting in...Accept that...What we tell clients is: Number one, you're in the fight, whether you thought you were or not. Number two, you're almost certainly penetrated.” Assume Breach Michael Hayden Former Director of CIA & NSA
  • 11. SCCM Microsoft’s System Center Configuration Manager
  • 12. What is SCCM? ● “System Center Configuration Manager” ○ Platform for distributing packages to clients ○ Packages, applications and install scripts are hosted on the SCCM server itself ● Setup and maintained via an agent/server architecture ● Essentially acts as internal RAT/C2 ○ Agents check in to server periodically to obtain new packages/applications
  • 13. SCCM in the Enterprise ● One central site server with multiple distribution points ● Often setup/configured using a service account to run the application/push updates ● Application contents (*cough, cough install scripts and notes*) are hosted on a publicly available share ● Admins gonna admin
  • 14.
  • 15. SQL vs. WMI for SCCM Management ● SCCM uses a combination of SQL and WMI to store lots of client information ○ Some of this can be viewed directly through the Configuration Manager interface, some can’t ● Bypassing the SCCM frontend and going straight for the backend can be tricky ○ Determining which method (SQL/WMI) to retrieve information or update information can also be a challenge as both have their advantages and disadvantages
  • 16. SQL ● SCCM utilizes a ‘normal’ SQL Server 2012 backend ○ Great for information retrieval (useful for Hunt) ○ Finicky for data modification ( for Red Teaming) ● Using SQL for pulling information from SCCM requires in-depth knowledge of the backend database ○ SCCM pulls from multiple locations for one requested piece of information
  • 18. SQL Schema ● v_GS_SERVICE – currently installed services ● v_HS_SERVICE – historical information on installed services ● v_GS_AUTOSTART_SOFTWARE – information about programs in a few auto start locations (note that this is not as complete as something like Autoruns) ● v_GS_PROCESS – information on currently running processes ● v_HS_PROCESS – historical information on running processes ● v_GS_CCM_RECENTLY_USED_APPS – information on recently used applications ● v_GS_SYSTEM_DRIVER – details on drivers currently installed ● v_GS_SYSTEM_CONSOLE_USER – information on console usage, complete with user information ● v_GS_SoftwareFile – details on inventoried files (more on this in ‘Tuning SCCM for Defense’ below) ● v_GS_BROWSER_HELPER_OBJECT – information on installed browser helper objects ● vMDMUsersPrimaryMachines – details on primary user -> machine mappings
  • 19. WMI ● SCCM’s WMI can be queried/updated using WMI Query Language (WQL) or PowerShell’s Get-WMIObject wrapper ○ Much easier for modification (instead of querying), so WMI tends to be better for red teaming ● WMI allows us to customize properties to fit SCCM’s requirements ○ For example, SCCM Applications require XML that defines the properties of the application (hidden, rights to run as, etc).
  • 21. Listing all Applications: WMI vs SQL ● WMI: ○ SELECT * FROM SMS_Application ● SQL:
  • 23. ● Encountered SCCM multiple times throughout many engagements but often ignored it due to our unfamiliarity ● Not a lot of public information on abusing it for malicious purposes and the process to actually abuse it was often tedious and manual ○ David Kennedy and Dave DeSimone gave a nice presentation on using SCCM at Defcon 20 (Owning One to Rule Them All) Background/Motivations
  • 24. Basic Usage ● Find-LocalSccmInfo: find the SCCM server/site code for a local machine ● New-SCCMSession: initiates a new session to the SCCM site server ○ Takes server name/site code/connection type ● Get-SccmSession: returns established sessions, pipeable to other functions ○ e.g. : Get-SccmSession | Get-SCCMApplication ● Remove-SccmSession: kill a SCCM session
  • 27. SCCM as an Attack Platform Using Admins’ Tools Against Them
  • 28. Hiding in Plain Sight ● SCCM traffic is completely normal in an enterprise network ● Admins and security staff have a harder time picking out malicious activity if it uses already existing technology. ● Instead of looking “like an adversary”, become a system administrator! ○ Utilize tools that exist and are expected in a target network
  • 29. Attacking SCCM Without DA ● Contrary to popular belief, attacking SCCM does not require Domain Admin rights ○ all you need is local admin rights on the SCCM server! ● Most organizations try to practice the concept of least privilege ● If you can compromise a server administrator or SCCM admin, you can compromise SCCM, and every machine administered by SCCM
  • 30. Targeting SCCM Admins ● PowerView’s Get-NetGroup function allows you to hunt for groups pertaining to SCCM ○ Get-NetGroup -GroupName *sccm* ● For domain users, some organizations separate out administrative functionality into multiple accounts for the same person ○ Group correlation can sometimes get a bit complicated ○ See Troopers 2016 “I Have the Power(View)”
  • 31. SCCM for code execution ● SCCM clients constantly check the SCCM server for any new content deployed to them ● We can: ○ Host a binary payload on an accessible share ○ Create a malicious deployment package/application ○ Push the application out to a target machine collection ● And the code executes as SYSTEM!
  • 32. Using PowerSCCM for ‘Evil’ Weaponizing Offensive SCCM
  • 33. Offensive Cmdlets New-SccmCollection Create a SCCM collection to place target computers/users in for application deployment. Add-SccmDeviceToCollection Add a computer to a device collection for application deployment. Add-SccmUserToCollection Add a domain user to a user collection for application deployment. New-SccmApplication Creates a hidden application via WMI that can be deployed to any collection. This application will not show up in the Configuration Manager Console New-SccmApplicationDeployment Deploys an application to a specific collection. Invoke-SCCMDeviceCheckin Forces all members of a collection to immediately check for Machine policy updates and execute any new applications available. Find-LocalSCCMInfo Queries the local SMS_Authority Class to determine the Site Code and the Management Point
  • 34. Hunting for Users ● PowerSCCM can ‘hunt’ for hosts that a user of interest last logged into: ○ Get-SCCMSession | Get-SCCMComputer | ?{$_. LastLogonUserName -eq "Matt"} ● You can also derive this information by observing the console usage logged by SCCM for each client: ○ Get-SCCMsession | Get-SccmConsoleUsage - SystemConsoleUserFilter "LABMatt" | Select-Object SystemName
  • 35. Hunting for Users (cont.)
  • 36. Grouping our Targets ● SCCM pushes content out only to specified user/device groups (known as “collections”) ● After identifying where our target users are logged in, we need to: ○ Group the targets into a device collection ○ Push out the malicious applications to the target collection ● Mass pwnage == bad , targeted/controlled pwnage == good
  • 37. Grouping using PowerSCCM ● We can create the Device collection using the New-SccmCollection cmdlet: ○ Get-SCCMSession | New-SccmCollection - CollectionName “targets” -CollectionType “Device” ● With the collection created, we can add our target hosts into it by using the Add- SccmDeviceToCollection cmdlet: ○ Get-SCCMSession | Add-SccmDeviceToCollection - ComputerNameToAdd "CORPWKSTNX64" - CollectionName "targets"
  • 38. Creating Malicious Applications ● PowerSCCM has heavily automated remotely creating malicious applications ○ This can be done entirely from a normal workstation (no RDP, etc.) by utilizing WMI ● SCCM stores a lot of the application info in the SMS_Application WMI class ○ We are able to create a new hidden application by populating the WMI class manually ○ Just set the ‘IsHidden’ field, yes it’s that easy
  • 39. Creating Malicious Applications (cont.) ● This can be done using PowerSCCM’s New- SccmApplication cmdlet ○ Get-SccmSession | New-SccmApplication - ApplicationName "myApp" -PowerShellB64 "Y21kIC9jIGNhbGMuZXhlCg==" ● This will: ○ stuff our payload in a WMI class (Win32_Debug) on the SCCM server ○ open that class up to “everyone” ○ set the application to fetch the payload and execute it
  • 41. Deploying Malicious Applications ● With targets grouped and applications created, deploying the application to the target group is the last step. ● PowerSCCM makes this simple to do via the New-SccmApplicationDeployment cmdlet:
  • 42. Forcing Clients to Check-in ● After deploying the application, the client needs to check-in before it will execute it. ● We can force client to check-in outside of the normal interval with Invoke- SccmDeviceCheckin: ○ We invoke the “InitiateClientOperation” method in the SMS_ClientOperation WMI class on the SCCM Server
  • 43. Using (Power)SCCM for ‘Good’ Why Not Use What’s Already Deployed?
  • 44. SCCM As a Defensive Solution ● Since SCCM already acts as an inventory agent for machines it’s installed on, we can take advantage of a number of the information gathering compoments ● Previous (defensive) work: ○ “Using SCCM to violate best practices” by Brandon Helms ○ “Microsoft’s Accidental Enterprise DFIR Tool” by Keith Tyler ○ “SCCM (System Center Configuration Manager) and Incident Response” part 1 and part 2 on the Hexacorn blog ○ “Mining For Evil” by John McLeod and Mike Pilkington at the SANS 2013 DFIR Summit
  • 45. Tuning SCCM For Defense (part 1) ● System Center Configuration Manager -> Administration -> ‘Client Settings’ -> client settings -> ‘Hardware Invetory’ -> Set Classes’ , ensure the following are enabled: ○ AutoStart Software – Asset Intelligence (SMS_AutoStartSoftware) ○ Browser Helper Object – Asset Intelligence (SMS_BrowserHelperObject) ○ Driver – VxD (Win32_DriverVXD) ○ Process (Win32_Process) ○ Recently Used Applications (CCM_RecentlyUsedApps) ○ Shares (Win32_Share) ○ System Console Usage – Asset Intelligence (SMS_SystemConsoleUsage) ○ System Console User – Asset Intelligence (SMS_SystemConsoleUser)
  • 46. Tuning SCCM For Defense (Part 2) ● Ensure that under Settings -> ‘Software Metering’ is enabled and the schedule is what you want for your environment:
  • 47. Tuning SCCM For Defense (Part 3) ● Under ‘Software Inventory’ set ‘Inventory these file types’ to all .exe’s on all hard disks:
  • 48. Defensive Cmdlets Get-SccmService Information about the current set of running services on Sccm clients Get-SccmServiceHistory Information about the historical set of running services on Sccm clients Get-SccmAutoStart Information about programs registered in various autostart locations on Sccm clients Get-SccmProcess Information about the current set of running processes on Sccm clients Get-SccmProcessHistory Information about the historical set of running processes on Sccm clients Get-SccmRecentlyUsedApplication Information on recently launched applications on Sccm clients Get-SccmDriver Information on drivers installed on Sccm clients Get-SccmConsoleUsage Information on console usage on Sccm clients, complete with user information Get-SccmSoftwareFile Information on inventoried software files Get-SccmBrowserHelperObject Information on browser helper objects installed on Sccm clients
  • 49. Defensive Cmdlets (Part 2) Find-SccmRenamedCMD Finds renamed cmd.exe executables using Get-SccmRecentlyUsedApplication and appropriate filters Find-SccmUnusualEXE Finds recently launched applications that don't end in *.exe using Get- SccmRecentlyUsedApplication and appropriate filters Find-SccmRareApplication Finds the rarest -Limit recently launched applications that don't end in *.exe using Get- SccmRecentlyUsedApplication and appropriate filters Find-SccmPostExploitation Finds recently launched applications commonly used in post-exploitation Find-SccmPostExploitationFile Finds indexed .exe's commonly used in post-exploitation Find-SccmMimikatz Finds launched mimikatz instances by searching the 'FileDescription' and 'CompanyName' fields of recently launched applications Find-SccmMimikatzFile Finds inventoried mimikatz.exe instances by searching the 'FileDescription' field of inventoried .exe's
  • 50. SCCM and Splunk ● You can configure Splunk to automatically ingest from the SCCM SQL server under ‘Connections’: http://informationonsecurity.blogspot.com/2015/11/microsofts-accidental-enterprise-dfir.html
  • 51. DEMOS
  • 52. Questions? ● Get PowerSCCM: https://github. com/powershellmafia/PowerSCCM/ ● Read more: ○ Red: http://enigma0x3.net/2016/02/29/offensive- operations-with-powersccm/ ○ Blue: http://www.harmj0y.net/blog/defense/powersccm/ ● Contact us: ○ @enigma0x3 ○ @harmj0y ○ #psempire on Freenode