{"id":"02122374-b74e-495c-b285-9e4da973f3d6","title":"DMSA Service Account Created in Specific OUs - PowerShell","description":"Detects the creation of a dMSA service account using the New-ADServiceAccount cmdlet in certain OUs.\nThe fact that the cmdlet is used to create a dMSASvc account in a specific OU is highly suspicious.\nIt is a pattern trying to exploit the BadSuccessor privilege escalation vulnerability in Windows Server 2025.\nOn top of that, if the user that is creating the dMSASvc account is not a legitimate administrator or does not have the necessary permissions,\nit is a strong signal of an attempted or successful abuse of the BaDSuccessor vulnerability for privilege escalation within the Windows Server 2025 Active Directory environment.\n","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"medium","date":"2025-05-24","modified":"","tags":["attack.privilege-escalation","attack.initial-access","attack.persistence","attack.stealth","attack.t1078.002","attack.t1098"],"technique_ids":["T1078.002","T1098"],"logsource":{"category":"ps_script","product":"windows"},"falsepositives":["Unknown"],"references":["https://www.akamai.com/blog/security-research/abusing-bad-successor-for-privilege-escalation-in-active-directory"],"source_path":"rules/windows/powershell/powershell_script/posh_ps_create_new_dmsasvc_account.yml","source_sha256":"f539953d436b3ec6bdcc2682c17b3f7aaef22bd276c1aff9994f53820e69fe4f","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_create_new_dmsasvc_account.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: DMSA Service Account Created in Specific OUs - PowerShell\nid: 02122374-b74e-495c-b285-9e4da973f3d6\nrelated:\n    - id: e15bc294-ae2a-45ad-b7d6-637b33868bde # Windows Security Creation of New MsDS-DelegatedManagedServiceAccount (DMSA) Object\n      type: similar\n    - id: 0ea8db81-2ff6-4525-9448-33bbe7effc13 # Process Creation Detection\n      type: similar\nstatus: experimental\ndescription: |\n    Detects the creation of a dMSA service account using the New-ADServiceAccount cmdlet in certain OUs.\n    The fact that the cmdlet is used to create a dMSASvc account in a specific OU is highly suspicious.\n    It is a pattern trying to exploit the BadSuccessor privilege escalation vulnerability in Windows Server 2025.\n    On top of that, if the user that is creating the dMSASvc account is not a legitimate administrator or does not have the necessary permissions,\n    it is a strong signal of an attempted or successful abuse of the BaDSuccessor vulnerability for privilege escalation within the Windows Server 2025 Active Directory environment.\nreferences:\n    - https://www.akamai.com/blog/security-research/abusing-bad-successor-for-privilege-escalation-in-active-directory\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems)\ndate: 2025-05-24\ntags:\n    - attack.privilege-escalation\n    - attack.initial-access\n    - attack.persistence\n    - attack.stealth\n    - attack.t1078.002\n    - attack.t1098\nlogsource:\n    category: ps_script\n    product: windows\ndetection:\n    selection:\n        ScriptBlockText|contains|all:\n            - 'New-ADServiceAccount'\n            - '-CreateDelegatedServiceAccount'\n            - '-path'\n    condition: selection\nfalsepositives:\n    - Unknown\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1078.002","id":"T1078.002","name":"Domain Accounts","page":"techniques/enterprise/T1078.002/"},{"key":"enterprise/T1098","id":"T1098","name":"Account Manipulation","page":"techniques/enterprise/T1098/"}],"data_path":"data/detection-rules/02122374-b74e-495c-b285-9e4da973f3d6.json","kind":"sigma"}