sccm-mecm-attack

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). 该技能提示包含大量示例命令直接将用户名、密码、哈希、证书私钥等凭据以命令行参数或连接字符串形式插入（例如 -u $USER -p $PASSWORD、$DOMAIN/$USER:$PASSWORD、--pki-key ./key.pem 等），要求在生成的命令/脚本中原样包含秘密值，存在高风险凭证外泄。

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This is a high-risk offensive playbook: it provides step‑by‑step instructions to discover SCCM infrastructure, steal credentials (NAA, DP files, DPAPI, task sequence secrets), perform NTLM relays and MSSQL/AdminService relays to inject administrators, and deploy/execute arbitrary payloads for lateral movement and site takeover — clearly intended for malicious exploitation.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). This is an explicit offensive playbook that instructs bypassing authentication (NTLM relay), extracting credentials, injecting SQL to add SCCM administrators, deploying malicious applications and executing commands — all actions that modify system state and enable takeover of target machines and services.