ConfigManBearPig 2.0 – Things Are Getting Cereal

Author

Chris Thompson

Read Time

4 mins

Published

Aug 3, 2026

TL;DR – In the past several years, security researchers have discovered 30+ unique attack techniques targeting Microsoft Configuration Manager (formerly SCCM), as its widespread control of an organization’s devices makes it an appealing target.

ConfigManBearPig 2.0 is a Python rewrite of the original PowerShell script that collects data from SCCM to identify the misconfigurations that make these attacks possible. Collected data can be uploaded to BloodHound, an open-source tool with Maps-style navigation and an interactive graph, to visualize, abuse, and remediate these attack paths.

Take me to the repos!

ConfigManBearPig: My SCCM collector
OpenHound: The SpecterOps Python framework for BloodHound collectors
openhound-collector-common: My OpenHound extensions for on-prem collection

Coverage

ConfigManBearPig provides coverage for the following techniques that are cataloged in the Misconfiguration Manager SCCM tradecraft knowledge base:

RECON: 6/7
CRED: 1/8
COERCE: 0/2
ELEVATE: 1/6
TAKEOVER: 9/9 (when paired with a SharpHound and MSSQLHound collection)
EXEC: 2/2

The vast majority of these techniques, including eight of the nine TAKEOVER techniques that allow complete control of the SCCM hierarchy, can be enumerated with any low-privileged domain user context.

I plan to expand coverage even further in the coming months, particularly in the CRED category.

Updates

ConfigManBearPig 2.0 supersedes and significantly improves upon the original PowerShell collector.

The largest gains you’ll notice are to speed, stealth options, and scalability. I received several reports that the PowerShell script was very slow or never finished in large enterprises. That should no longer be the case. ConfigManBearPig 2.0 builds on top of and extends the OpenHound collection framework to prevent system resource exhaustion while processing nodes and edges for many targets at a time.

In my Ludus SCCM lab (based on work by my colleague Zach Stein), there was a 56%-ish increase in speed. In a much larger enterprise environment, I expect that number only gets higher due to the memory saved using local storage and processing in DuckDB.

As a result of switching to Python, ConfigManBearPig can now easily be run from a Linux machine.

I also added the following features:

Pathfinding in BloodHound via new OpenGraph schema
Proxy traffic via SOCKS (-x or --proxy)
Authenticate with an NT hash or a Base64-encoded Kerberos ticket in addition to Windows integrated and username/password (--nt-hash or --ticket)
Identify vulnerability CVEs applicable to the observed SCCM build versions (using Mehdi Elyassa’s SCCMVersionGuesser)
Execute against multiple targets in parallel (-t or --threads, default: 10)
Diagnostic logging per target and collection phase

OPSEC

I haven’t personally seen many detections or deceptions for SCCM tradecraft implemented in the wild, although there are plenty of ideas in the Misconfiguration Manager project that you can use to implement your own, thanks to my colleague Josh Prager.

ConfigManBearPig was not designed for stealth on the system where it is executed. OpenHound writes collected resource files and a DuckDB database to disk and collection results in a large number of network connections over various protocols.

If you want to tread lightly and still get useful data from the tool, use -m LDAP,DNS,Local or the --dc-only flag (LDAP+DNS) to identify SCCM infrastructure to attack with other tools while only touching a domain controller and the local system.

Better yet, spin up a SOCKS proxy and send ConfigManBearPig’s traffic through the tunnel using the --proxy (-x) option so that no files are created on disk.

Please check out the --help CLI option, the project README, and the introductory blog post for tips on using ConfigManBearPig in operations.

What Changed?

The full details of all changes made can be found in ARCHITECTURE.md, README.md, and .tickets (if you want to go real deep).

If you encounter any issues, please reach out to me on the BloodHound Slack or open an issue on the GitHub repo (or better yet, a PR!). Please include a redacted copy of the full diagnostic log that is created by default (collect_full_<timestamp>.log), if possible, or send to me privately to review.

So long for now!

I’m always looking to collaborate with more people in the community! If you have questions, ideas, or want to contribute but don’t know how, please hit me up on X (@_Mayyhem) or in the #sccm channel in the BloodHound Slack!

This blog post accompanies my presentation at Black Hat USA Arsenal on August 4th, 2026 (Tuesday). I’ll be at station 6 in the business hall from 5:15 – 6:15 PM. Come hang out, learn how to use ConfigManBearPig, and snag some stickers!

Post Views: 1

Chris Thompson

Senior Security Researcher

Chris is a Sr. Security Researcher at SpecterOps, where he researches attack paths in widely-used software such as SCCM, MSSQL, and Intune and develops open-source tools to identify, abuse, and prevent them. Chris has led red teams, network, webapp, and wireless pentests, instructed at Black Hat , DEF CON, SO-CON, and SpecterBash, and spoken at Black Hat Arsenal, DEF CON Demo Labs, Troopers, SO-CON, and MMS.