Possible Change of DMSA Link Attributes (via ps_script)

title: Possible Change of DMSA Link Attributes (via ps_script)
id: 9fae7e69-ae1b-57e8-9db0-dd6569c246f3
status: stable
description: This rule detects modification of dMSA link attributes (msDS-ManagedAccountPrecededByLink) via PowerShell scripts. This command line pattern could be an indicator an attempt to exploit the BadSuccessor privilege escalation vulnerability in Windows Server 2025.
references:
    - https://attack.mitre.org/techniques/T1098/
    - https://attack.mitre.org/techniques/T1078/002/
    - https://www.akamai.com/blog/security-research/abusing-bad-successor-for-privilege-escalation-in-active-directory
author: Huntrule Team
date: 2026-04-20
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.initial-access
    - attack.stealth
    - attack.t1078.002
    - attack.t1098
logsource:
    category: ps_script
    product: windows
detection:
    selection:
        ScriptBlockText|contains|all:
            - '.Put("msDS-ManagedAccountPrecededByLink'
            - 'CN='
    condition: selection
falsepositives:
    - Unknown
level: low