I'm not actually an SCCM admin...I just implied it

Garrett Foster (@unsigned_sh0rt)

Burning River Cyber Con

November 15, 2025

SlidesSCCM · Active Directory · Offensive Security

November 15, 2025

Slide deck

View inline above or open in a new tab for your browser's PDF viewer.

View in new tab Download PDF

Speaker

Garrett Foster (@unsigned_sh0rt)

Offensive Security Researcher

Garrett Foster is an offensive security researcher with over six years in IT and security, having worked across the finance, healthcare, and energy sectors. His roles have included SOC analyst and systems administration, and he now focuses on offensive research into Active Directory and enterprise tooling. Garrett publishes tooling and research to help the security community understand attack pathways and improve defenses.

Talk overview

Microsoft Configuration Manager (SCCM) remains a core endpoint management tool for many enterprises and carries significant legacy complexity. In this talk Garrett demonstrates real-world techniques attackers use to abuse SCCM assumptions and dependencies to escalate privileges, impersonate administrative roles, or achieve persistence. The session includes concrete case examples, an attacker's methodology, and practical mitigations administrators can apply to reduce exposure.

Share

Share this talk with your crew or on social.

Share on X Share on Bluesky