huntrule

Suspicious Modification of dMSA Managed Account Link Attributes

PremiumReviewedSigma · High · v1
Product
windows
Service
security
Author
HuntRule
Published
2026-07-06
Updated
2026-08-28
AnalysisDetection

ATT&CK techniques

Persistence → Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects directory modifications to the msDS-ManagedAccountPrecededByLink or msDS-DelegatedMSAState attributes of a delegated Managed Service Account. The BadSuccessor attack abuses these dMSA attributes to inherit privileges from a targeted account and escalate in Active Directory. Changes to these attributes outside sanctioned administration indicate an escalation attempt.

Reporting behind it

Related detections9 linkedT1098 — drag to rearrange
Malicious Cluster-Admin Role Binding Creation (via audit)
Malicious User Password Change Using Current Hash Password - ChangeNTLM - Mimikatz (via security)
Suspicious Account Password Set to Never Expire. (via security)
Malicious Modification of a Computer Account SPN (via security)
Suspicious Massive Group Membership Changes (via security)
Malicious High Risk Active Directory Group Membership Change (via security)
Malicious Account Marked as Sensitive and Cannot Be Delegated Had Its Protection Removed (via security)
Malicious Host Constrained Delegation Settings Changed for Potential Abuse (Rubeus) - Kerberos Only (via security)
Malicious Host Set with Unconstrained Delegation (via security)
Suspicious Modification of dMSA Managed Account Link Attributes
Pivot detection · T1098 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.