Skip to content
Threat Feed
Subscribe

Tag

Attack.t1098

1 brief RSS
medium advisory

Suspicious dMSA Service Account Creation Attempting BadSuccessor Abuse

The creation of a delegated managed service account (dMSA) in specific Active Directory organizational units (OUs) via PowerShell, especially when the initiating user lacks proper permissions, indicates a potential attempt to exploit the BadSuccessor privilege escalation vulnerability in Windows Server 2025 environments.

Active Directory +1 attack.privilege-escalation attack.initial-access attack.defense-evasion attack.persistence attack.t1078.002 attack.t1098
2r 4t