Bad-Successor - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/bad-successor/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 08 Jan 2024 15:00:00 +0000Creation of New DMSA Service Account Potentially Exploiting BadSuccessor Vulnerabilityhttps://feed.craftedsignal.io/briefs/2024-01-08-bad-successor-dmsa/Mon, 08 Jan 2024 15:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-08-bad-successor-dmsa/The creation of a new Delegated Managed Service Account (DMSA) within specific Organizational Units (OUs) using the New-ADServiceAccount cmdlet is indicative of potential BadSuccessor privilege escalation attempts in Windows Server 2025 Active Directory environments.The observed activity involves the suspicious creation of a Delegated Managed Service Account (dMSASvc) using the New-ADServiceAccount cmdlet within specific, targeted Organizational Units (OUs) in Windows Server 2025 Active Directory environments. This pattern is strongly associated with attempts to exploit the BadSuccessor vulnerability, a privilege escalation technique. The creation of a DMSA account in a specific OU, especially by a user without legitimate administrative privileges, raises significant concerns. This activity, first highlighted in late 2025, signifies an attacker attempting to gain elevated permissions within the Active Directory domain by abusing the delegation capabilities of DMSA accounts. Defenders should closely monitor for this behavior.

Attack Chain

  1. Initial access to a system within the target domain is achieved, potentially through compromised credentials or exploiting a separate vulnerability.
  2. The attacker leverages PowerShell (powershell.exe or pwsh.exe) to execute commands.
  3. The New-ADServiceAccount cmdlet is invoked with the -CreateDelegatedServiceAccount parameter.
  4. The -Path parameter specifies a target Organizational Unit (OU) within the Active Directory. The specific OU is often chosen based on its existing permissions and delegation configurations.
  5. The command attempts to create a new dMSASvc account within the specified OU.
  6. If successful, the attacker gains control over the newly created dMSASvc account.
  7. The attacker misuses the delegation rights associated with the dMSASvc account to impersonate other users or services.
  8. The attacker escalates privileges and achieves lateral movement within the Active Directory environment, potentially gaining domain administrator access.

Impact

Successful exploitation of the BadSuccessor vulnerability can lead to complete domain compromise. Attackers can gain control of sensitive accounts, access confidential data, and disrupt critical business operations. The Akamai report highlights the potential for widespread damage, and the focus on Windows Server 2025 indicates a modern attack targeting recent infrastructure.

Recommendation

  • Deploy the Sigma rule "New DMSA Service Account Created in Specific OUs" to your SIEM to detect suspicious DMSA creation activity and tune for your environment.
  • Monitor process creation logs for PowerShell execution involving the New-ADServiceAccount cmdlet and the -CreateDelegatedServiceAccount parameter.
  • Review and restrict Active Directory permissions to prevent unauthorized DMSA account creation.
  • Investigate and remediate any identified instances of unauthorized DMSA account creation.
]]>mediumadvisoryprivilege-escalationactive-directorybad-successordmsa