Security & Threat Intelligence · 03.08.2026, 16:03 UTC
ConfigManBearPig 2.0 – Things Are Getting Cereal
| Schweregrad | info |
|---|---|
| Kategorie | Security & Threat Intelligence |
| Quelle | SpecterOps ↗ |
| Veröffentlicht | 03.08.2026 UTC |
Sicherheitsmeldung mit Schweregrad noch nicht bewertet. Technische Details im Tab „Originaltext“; empfohlene Schritte in der Checkliste.
TL;DR – In the past several years, security researchers have discovered 30+ unique attack techniques targeting Microsoft Configuration Manager (formerly SCCM), as its widespread control of an organization’s devices makes it an appealing target.
ConfigManBearPig 2.0 is a Python rewrite of the original PowerShell script that collects data from SCCM to identify the misconfigurations that make these attacks possible. Collected data can be uploaded to BloodHound, an open-source tool with Maps-style navigation and an interactive graph, to visualize, abuse, and remediate these attack paths.
Take me to the repos!
ConfigManBearPig: My SCCM collector
OpenHound: The SpecterOps Python framework for BloodHound collectors
openhound-collector-common: My OpenHound extensions for on-prem collection
Coverage
ConfigManBearPig provides coverage for the following techniques that are cataloged in the Misconfiguration Manager SCCM tradecraft knowledge base:
RECON: 6/7
CRED: 1/8
COERCE: 0/2
ELEVATE: 1/6
TAKEOVER: 9/9 (when paired with a SharpHound and MSSQLHound collection)
EXEC: 2/2
The vast majority of these techniques, including eight of the nine TAKEOVER techniques that allow complete control of the SCCM hierarchy, can be enumerated with any low-privileged domain user context.
I plan to expand coverage even further in the coming months, particularly in the CRED category.
Updates
ConfigManBearPig 2.0 supersedes and significantly improves upon the original PowerShell collector.
The largest gains you’ll notice are to speed, stealth options, and scalability. I received several …