LOLMgmt When Administration Becomes Attack

Most enterprise defenders treat the systems that manage their fleets as pure infrastructure, when those systems are also among the most powerful attack surfaces in the enterprise: the systems for configuration management, mobile-device management, software deployment, and orchestration. This paper argues that treating them as mere infrastructure is a category error with measurable consequences. A class of high-impact incidents keeps being described as unprecedented, among them SolarWinds, SaltStack, Kaseya, and the March 2026 Intune-driven wipe of Stryker, when in fact they are instances of a single recurring pattern, produced by a shared architectural property rather than by shared software. We name that class the management plane, define it by capability rather than by product, and identify the property that makes it dangerous: a management plane exposes no technical distinction between legitimate and malicious administration. The argument is grounded in a fully worked SCCM (System Center Configuration Manager) attack chain against a production-representative lab, and the detection gap it opens is measured against the open-source Sigma corpus, which contains no rule that sees it with any precision. The paper closes by arguing that the field has invested heavily in making authority hard to obtain and comparatively little in bounding what authority can do once obtained, and proposes a set of engineering principles for the latter.