Executive Summary
Security researchers have identified a novel attack vector involving the Microsoft System Center Configuration Manager (SCCM) client service, CcmExec. By leveraging administrator privileges, an attacker can exploit the way CcmExec manages user notifications to achieve session hijacking across all active interactive sessions on a Windows host. This method provides a stealthier alternative to traditional remote process injection, which is frequently flagged by modern EDR solutions.
The attack utilizes AppDomainManager injection, a technique that hijacks the .NET runtime loading process. By modifying the configuration file for SCNotification.exe, an attacker can force the service to load a malicious DLL or coerce authentication requests (SMB/HTTP) from every logged-in user. This can lead to full session takeover, keylogging, or lateral movement via credential relaying.
This technique is particularly significant for organizations with mature security postures using SCCM, as it weaponizes a trusted native service. A proof-of-concept tool named CcmPwn has been released, demonstrating the ease with which these sessions can be compromised once administrative access is obtained.
Key Details
Threat Name
—
Affects
—
Adversary
—
MITRE Techniques
—
Malware/Tools
None identified