Skip to content
Threat Feed

Product

Logs-Windows.forwarded*

1 brief RSS
high advisory

Unusual dMSA Account Creation for Privilege Escalation

Detects the creation of a delegated Managed Service Account (dMSA) by an unusual subject account, potentially indicating an attempt to abuse weak permissions for privilege escalation in Active Directory.

winlogbeat-* +2 privilege-escalation windows
3r 1t