PowerShell: Modify dMSA link attribute msDS-ManagedAccountPrecededByLink in AD

Flags PowerShell script content modifying msDS-ManagedAccountPrecededByLink (dMSA link attributes) via AD link changes.

FreeUnreviewedSigmalowv1

powershell-modify-dmsa-link-attribute-msds-managedaccountprecededbylink-in-ad-9b111d8e

title: "PowerShell: Modify dMSA link attribute msDS-ManagedAccountPrecededByLink in AD"
id: 3c4dbe53-1130-4c7c-a3ed-bae6b11f500c
related:
  - id: 6c9eb492-e477-4df9-b0f4-571fc9db29cd
    type: similar
  - id: 9b111d8e-92e0-4153-88bc-daefc1333aba
    type: derived
status: experimental
description: This rule flags PowerShell script block content that includes updates to the dMSA link attribute msDS-ManagedAccountPrecededByLink, indicating directory object link manipulation (including CN= components). Such changes are significant because they can be used to establish or alter Active Directory relationship paths that may support persistence or privilege escalation attempts. The detection relies on PowerShell script block telemetry capturing the presence of the specific attribute name and CN= text in the same command string.
references:
  - https://www.akamai.com/blog/security-research/abusing-bad-successor-for-privilege-escalation-in-active-directory
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_modification_of_dmsa_link_attribute.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-05-24
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.initial-access
  - attack.stealth
  - attack.t1078.002
  - attack.t1098
logsource:
  category: ps_script
  product: windows
detection:
  selection:
    ScriptBlockText|contains|all:
      - .Put("msDS-ManagedAccountPrecededByLink
      - CN=
  condition: selection
falsepositives:
  - Legitimate administrative tasks modifying these attributes.
level: low
license: DRL-1.1

What it detects

This rule flags PowerShell script block content that includes updates to the dMSA link attribute msDS-ManagedAccountPrecededByLink, indicating directory object link manipulation (including CN= components). Such changes are significant because they can be used to establish or alter Active Directory relationship paths that may support persistence or privilege escalation attempts. The detection relies on PowerShell script block telemetry capturing the presence of the specific attribute name and CN= text in the same command string.

Known false positives

Legitimate administrative tasks modifying these attributes.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.