SCCM Network Access Account disclosure → privileged creds

§ Context

Assumed environment: workstation is SCCM-managed (client installed) and uses an NAA for software distribution. The NAA password is decryptable by the local SYSTEM account.

§ Steps

1. 01
   Authenticate as NAAInitial Access

   T1078— Valid Accounts
2. 02
   Local user on managed endpointInitial Access

   T1078— Valid Accounts
3. 03
   Local SYSTEM (UAC bypass / token)Privilege Escalation

   T1548— Abuse Elevation Control Mechanism

   Or local admin.

4. 04
   BloodHound for NAA → path to DADiscovery

   AD-BLOODHOUND— BloodHound / SharpHound Enumeration
5. 05
   Read NAA from CIM_NetworkAccessAccountCredential Access

   AD-SCCM-NAA— SCCM Network Access Account Disclosure

   SharpSCCM.exe local secrets

§ References

• T1078Valid Accounts
• T1548Abuse Elevation Control Mechanism

§ Frequently asked

What is the "SCCM Network Access Account disclosure → privileged creds" attack path?

Any authenticated user on a SCCM-managed endpoint can recover the Network Access Account credentials from WMI / client cache — and the NAA is usually over-privileged. It chains 5 steps drawn from real-world offensive-security techniques.

What starting position does this attack require?

The first step is Authenticate as NAA (T1078) — a initial access primitive. Assumed environment: workstation is SCCM-managed (client installed) and uses an NAA for software distribution.

What is the final impact of this kill-chain?

The final step lands on Read NAA from CIM_NetworkAccessAccount (AD-SCCM-NAA), which falls under Credential Access. From here, an operator typically pivots into post-exploitation or maintains persistence.

How can defenders detect or prevent this attack?

Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers

• Shared techniques2

  Leaked legacy VPN credential → ransomware (Colonial-class)

  A dormant VPN account whose password appeared in a third-party breach is still active, has no MFA enforced. Sign in, recon AD, deploy ransomware across the estate.

• Shared techniques2

  Citrix Bleed → steal authenticated session → MFA bypass

  Send a long Host header to a vulnerable NetScaler — memory disclosure leaks an authenticated session token already past MFA. Replay the token to log into the corporate VPN.

• Shared techniques2

  WriteDACL on a privileged user → ForceChangePassword → takeover

  Discover a misconfigured ACL that lets a low-priv user modify the ACL of a Tier-0 account, grant ForceChangePassword to themselves, reset the victim's password, and log in.

• Shared techniques2

  GenericWrite on Domain Admins → AddMember → DA

  A misconfigured 'member' attribute write on a privileged group lets the attacker silently add themselves as a Domain Admin.

• Shared techniques2

  Unconstrained delegation → Capture DC TGT → DCSync

  Compromise a host with TRUSTED_FOR_DELEGATION, coerce a DC to authenticate to it, harvest the DC's TGT from its LSASS, then DCSync.

• Shared techniques2

  Group Policy Preferences cpassword → user takeover

  Pre-MS14-025 GPPs left cpassword-encrypted credentials in SYSVOL with a published AES key. Any authenticated user can decrypt them.