Non-Admin Enumeration of SCCM User-Device Relationships

Duo Tech@duotech

•updated Aug 27, 2026•8•0•15

Detects non-administrative access querying SCCM to enumerate user-device relationships, used by CISA's red team to identify which workstations belonged to high-value targets.