{"id":"9b111d8e-92e0-4153-88bc-daefc1333aba","title":"DMSA Link Attributes Modified","description":"Detects modification of dMSA link attributes (msDS-ManagedAccountPrecededByLink) via PowerShell scripts.\nThis command line pattern could be an indicator an attempt to exploit the BadSuccessor privilege escalation vulnerability in Windows Server 2025.\n","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"low","date":"2025-05-24","modified":"","tags":["attack.privilege-escalation","attack.persistence","attack.initial-access","attack.stealth","attack.t1078.002","attack.t1098"],"technique_ids":["T1078.002","T1098"],"logsource":{"category":"ps_script","product":"windows"},"falsepositives":["Legitimate administrative tasks modifying these attributes."],"references":["https://www.akamai.com/blog/security-research/abusing-bad-successor-for-privilege-escalation-in-active-directory"],"source_path":"rules/windows/powershell/powershell_script/posh_ps_modification_of_dmsa_link_attribute.yml","source_sha256":"af566b45640475635b7a4c0e06b89eb3f6e424d53b41592c064c3a39ee7ab694","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_modification_of_dmsa_link_attribute.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: DMSA Link Attributes Modified\nid: 9b111d8e-92e0-4153-88bc-daefc1333aba\nrelated:\n    - id: 6c9eb492-e477-4df9-b0f4-571fc9db29cd # Windows Security Modification of msDS-ManagedAccountPrecededByLink Attribute\n      type: similar\nstatus: experimental\ndescription: |\n    Detects modification of dMSA link attributes (msDS-ManagedAccountPrecededByLink) via PowerShell scripts.\n    This command line pattern could be an indicator an attempt to exploit the BadSuccessor privilege escalation vulnerability in Windows Server 2025.\nreferences:\n    - https://www.akamai.com/blog/security-research/abusing-bad-successor-for-privilege-escalation-in-active-directory\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems)\ndate: 2025-05-24\ntags:\n    - attack.privilege-escalation\n    - attack.persistence\n    - attack.initial-access\n    - attack.stealth\n    - attack.t1078.002\n    - attack.t1098\nlogsource:\n    category: ps_script\n    product: windows\ndetection:\n    selection:\n        ScriptBlockText|contains|all:\n            - '.Put(\"msDS-ManagedAccountPrecededByLink'\n            - 'CN='\n    condition: selection\nfalsepositives:\n    - Legitimate administrative tasks modifying these attributes.\nlevel: low\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1078.002","id":"T1078.002","name":"Domain Accounts","page":"techniques/enterprise/T1078.002/"},{"key":"enterprise/T1098","id":"T1098","name":"Account Manipulation","page":"techniques/enterprise/T1098/"}],"data_path":"data/detection-rules/9b111d8e-92e0-4153-88bc-daefc1333aba.json","kind":"sigma"}