Misconfiguration Manager
A knowledge base documenting known Microsoft Configuration Manager attack techniques alongside matching defensive and hardening guidance, for red teamers and defenders.
Misconfiguration Manager is a central knowledge base of tradecraft for Microsoft Configuration Manager, also known as MCM, ConfigMgr or SCCM, pairing each documented attack technique with defensive and hardening guidance. It is organized loosely along the lines of the MITRE ATT&CK framework, aiming to demystify SCCM tradecraft for defenders while also educating offensive security professionals about this attack surface.
A suggested remediation path is to review the listed attack and defense techniques against one's own environment, run tools such as ConfigManBearPig and visualize the results in BloodHound, or run a companion PowerShell script, MisconfigurationManager.ps1, before implementing the matching mitigations. The project accepts contributions of both proven and exploratory SCCM attack and defense techniques.
It is maintained by SpecterOps, draws on misconfigurations the maintainers have seen in real environments as well as lab research, and is written in PowerShell under the GPL-3.0 license.