Loading story…
Researchers detailed attack paths in Microsoft System Center Operations Manager (SCOM) that can let a low-privilege domain user gain SCOM administrative rights and execute tasks on managed systems. The principal technique coerces authentication from a SCOM Management Server whose MSOMSdkSvc Data Access Service SPN is assigned to the computer account, then relays NTLM authentication to the OperationsManager SQL database to add an attacker-controlled SID to the AzMan_Role_SIDMember authorization table. The resulting SCOM access can be used through the Operations Console to run tasks under configured Action Accounts, potentially reaching SYSTEM privileges on monitored domain controllers.
Researchers also warned that SCOM Action Account and Run As credentials are stored as DPAPI-protected registry data on managed hosts and may be recovered by local administrators, particularly where Run As accounts use less-secure credential distribution. Recommended defenses include moving the Data Access Service identity and SPN to a gMSA, limiting Run As credential distribution, using SYSTEM Action Accounts where appropriate, disabling the web-console PowerShell widget, and auditing LDAP, SQL, and network activity associated with relay and authorization changes; Microsoft Event ID 1644 can provide visibility into costly or anomalous LDAP queries.
Get the actors, campaigns, and ATT&CK mapping behind it.
1 event from the most recent confirmed update back to the earliest known activity.
Researchers described attack paths in Microsoft System Center Operations Manager that can allow a low-privilege domain user to relay coerced Management Server authentication to the OperationsManager SQL database, add an attacker SID to a SCOM administrative role, and execute tasks on managed endpoints. The disclosure also detailed recovery of locally stored DPAPI-protected Action and Run As credentials by administrators of managed hosts, along with mitigations and detection guidance.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
3 references tracked. Mallory keeps watching after this page renders.
guidepointsecurity.com
Open sourcelearn.microsoft.com
Open sourcespecterops.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft patched **CVE-2024-38061**, an Important-severity Windows DCOM vulnerability that could let low-privileged users remotely activate a DCOM application on a domain controller and coerce NTLM authentication from a privileged interactive user. The issue affected scenarios in which members of groups such as **Distributed COM Users** or **Performance Log Users** could trigger `sppui/slui.exe` under the logged-on user’s context, potentially targeting Domain Administrator sessions. An attacker could capture the coerced authentication and relay it to services such as SMB, including systems supporting Active Directory Certificate Services (AD CS), to obtain further privileges. Researchers demonstrated a path from relayed authentication to compromise of an AD CS server and ultimately Domain Admin access through certificate abuse; organizations should apply Microsoft’s update and treat the affected DCOM group memberships as Tier 0 privileges, while using protections such as Protected Users for administrative accounts to reduce NTLM-relay exposure.
Sep 3, 2026
Two separate Windows authentication weaknesses were highlighted as enabling high-impact **Active Directory** compromise via relay-style attacks. One issue, **CVE-2025-33073**, affects Windows **SMB client** authentication and enables **NTLM reflection**: attackers can coerce `lsass.exe` (running as **SYSTEM**) to authenticate to attacker-controlled infrastructure using techniques such as *PetitPotam*, *DFSCoerce*, and *Printerbug*, then relay/reflect that authentication to gain SYSTEM-level access and potentially full domain compromise. Reporting emphasized that despite a June 2025 patch, the condition remains widely present in enterprise environments due to incomplete patch adoption, and exploitation can be enabled with relatively low prerequisites such as the ability to register a malicious AD DNS record (often permitted to Authenticated Users by default) or to perform local DNS poisoning. A second technique described a **Kerberos relay** vector that abuses how Windows clients process **DNS CNAME** responses when building the SPN for TGS requests, allowing an on-path attacker (e.g., via ARP poisoning or DHCPv6/mitm6) to redirect victims to attacker-controlled services and obtain service tickets usable for relays and lateral movement. The write-up claims default configurations across Windows 10/11 and Windows Server 2022/2025 are susceptible, with potential impact including cross-protocol relays (e.g., HTTP→SMB/LDAP) and paths to RCE in some environments (e.g., via ADCS web enrollment scenarios). A separate Metasploit weekly wrap-up noted new and updated offensive modules (including AD privilege-escalation content), but it did not specifically tie to either of the two relay issues above.
Jun 30, 2026
Huntress disclosed **"dMSA Ouroboros,"** a technique that abuses delegated Managed Service Accounts (dMSAs) in fully patched **Windows Server 2025** to create self-sustaining persistence and repeatedly extract credentials. The method chains delegated `CreateChild` and `WriteProperty` permissions with object ownership, **Shadow Credentials** stored in `msDS-KeyCredentialLink`, and self-referential `msDS-GroupMSAMembership` entries so a rogue dMSA can authenticate and authorize itself to recover the superseded account's **NT hash**. The researchers said the approach builds on Akamai's **BadSuccessor** work and differs from Semperis's **Golden dMSA** research by focusing on post-creation abuse paths. According to the report, the attack survives password rotation, can persist even after the original attacker account is deleted, and may prevent **Domain Admins** from fully remediating the compromise unless the malicious dMSA object itself is removed. Huntress said Microsoft's patch for **`CVE-2025-53779`** did not address this abuse path and that Microsoft classified the issue as a persistence mechanism rather than an elevation-of-privilege flaw, declining to issue a further fix. The firm urged defenders to audit delegated `CreateChild` rights, monitor dMSA creation by non-admin users, and hunt for suspicious `msDS-KeyCredentialLink` values and self-SID entries in `msDS-GroupMSAMembership` on dMSA objects.
Jun 29, 2026