Dmsa - CraftedSignal Threat Feed

Potential DMSA Abuse for Privilege Escalation

hello@craftedsignal.io — Wed, 31 Jan 2024 12:00:00 +0000

This brief addresses the potential for privilege escalation on Windows systems through the abuse of the Default Message Security Agent (DMSA). While the specific exploit details are not provided in this source, it's important to monitor for suspicious registry modifications related to DMSA that could indicate an attempt to elevate privileges. The observed behavior involves changes to registry keys associated with DMSA, potentially redirecting or modifying its execution path to inject malicious code. Defenders should be aware of any unauthorized modifications to DMSA-related registry settings as these could lead to complete system compromise.

Attack Chain

Attacker gains initial access to the system (details not specified).
Attacker identifies the DMSA registry keys used to control the execution path.
Attacker modifies the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DMSAgent to point to a malicious executable.
The malicious executable is crafted to perform privileged actions.
The attacker triggers the DMSA service, either directly or indirectly through a system event.
The DMSA service executes the malicious executable with elevated privileges.
The attacker gains control of the system with the privileges of the DMSA service account.
The attacker performs further actions such as installing backdoors or exfiltrating data.

Impact

Successful exploitation of DMSA can lead to complete system compromise. An attacker who successfully escalates privileges can gain full control of the affected machine, allowing them to install malware, steal sensitive data, or disrupt critical services. Given the potential for widespread impact, proactive monitoring and detection of suspicious DMSA activity are essential for maintaining the security and integrity of Windows environments.

Suspicious Domain Managed Service Account Creation by Unusual User

hello@craftedsignal.io — Tue, 09 Jan 2024 10:00:00 +0000

This alert focuses on detecting anomalous creation of Domain Managed Service Accounts (DMSAs) within a Windows environment. DMSAs are privileged accounts used to run services and applications. The creation of these accounts should typically be restricted to a small set of administrators. When a user outside of this group creates a DMSA, it could indicate malicious activity such as privilege escalation, lateral movement from a compromised account, or an insider threat. This detection aims to identify unusual DMSA creation events, helping security teams quickly investigate and respond to potential security breaches. The rule is based on identifying deviations from the norm in terms of who is creating these accounts.

Attack Chain

An attacker gains initial access to a low-privilege user account, possibly through phishing or password compromise.
The attacker performs reconnaissance to identify potential privilege escalation paths within the domain.
The attacker attempts to create a DMSA using tools like New-ADServiceAccount PowerShell cmdlet or AD management tools.
The attacker leverages the newly created DMSA to gain elevated privileges within the network.
The attacker uses the compromised DMSA to access sensitive resources or systems.
The attacker may install malware or backdoors on critical systems using the DMSA credentials.
The attacker may then perform lateral movement to compromise additional systems and escalate privileges further.

Impact

A successful DMSA creation by an unauthorized user can lead to significant privilege escalation within the Active Directory domain. This can provide attackers with administrative control over critical systems and data, enabling them to steal sensitive information, disrupt services, and potentially deploy ransomware across the entire organization. The scope of the attack can be broad, potentially affecting all systems and users within the domain.

Creation of New DMSA Service Account Potentially Exploiting BadSuccessor Vulnerability

hello@craftedsignal.io — Mon, 08 Jan 2024 15:00:00 +0000

The observed activity involves the suspicious creation of a Delegated Managed Service Account (dMSASvc) using the New-ADServiceAccount cmdlet within specific, targeted Organizational Units (OUs) in Windows Server 2025 Active Directory environments. This pattern is strongly associated with attempts to exploit the BadSuccessor vulnerability, a privilege escalation technique. The creation of a DMSA account in a specific OU, especially by a user without legitimate administrative privileges, raises significant concerns. This activity, first highlighted in late 2025, signifies an attacker attempting to gain elevated permissions within the Active Directory domain by abusing the delegation capabilities of DMSA accounts. Defenders should closely monitor for this behavior.

Attack Chain

Initial access to a system within the target domain is achieved, potentially through compromised credentials or exploiting a separate vulnerability.
The attacker leverages PowerShell (powershell.exe or pwsh.exe) to execute commands.
The New-ADServiceAccount cmdlet is invoked with the -CreateDelegatedServiceAccount parameter.
The -Path parameter specifies a target Organizational Unit (OU) within the Active Directory. The specific OU is often chosen based on its existing permissions and delegation configurations.
The command attempts to create a new dMSASvc account within the specified OU.
If successful, the attacker gains control over the newly created dMSASvc account.
The attacker misuses the delegation rights associated with the dMSASvc account to impersonate other users or services.
The attacker escalates privileges and achieves lateral movement within the Active Directory environment, potentially gaining domain administrator access.

Impact

Successful exploitation of the BadSuccessor vulnerability can lead to complete domain compromise. Attackers can gain control of sensitive accounts, access confidential data, and disrupt critical business operations. The Akamai report highlights the potential for widespread damage, and the focus on Windows Server 2025 indicates a modern attack targeting recent infrastructure.

Recommendation

Deploy the Sigma rule "New DMSA Service Account Created in Specific OUs" to your SIEM to detect suspicious DMSA creation activity and tune for your environment.
Monitor process creation logs for PowerShell execution involving the New-ADServiceAccount cmdlet and the -CreateDelegatedServiceAccount parameter.
Review and restrict Active Directory permissions to prevent unauthorized DMSA account creation.
Investigate and remediate any identified instances of unauthorized DMSA account creation.