Researchers expose Microsoft SCCM misconfigs usable in cyberattacks

SpecterOps released Misconfiguration Manager, a repository cataloging attack paths and defenses stemming from misconfigured Microsoft Configuration Manager (SCCM/MCM). The resource documents 22 techniques that can enable credential access, privilege escalation, reconnaissance, and hierarchy takeover—such as overprivileged Network Access Accounts, enrolling domain controllers as clients, and CAS database abuse—while providing corresponding PREVENT, DETECT, and CANARY guidance to help administrators harden deployments.