Windows HackTool Execution: GoldenDMSA.exe Launch with Directory Manipulation Parameters
Detects execution of GoldenDMSA.exe with command-line indicators consistent with wordlist/bruteforce directory account manipulation.
- Product
- windows
- Category
- process_creation
- Author
- Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2026-10-19
- Updated
- 2026-10-21
ATT&CK techniques
Persistence → Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process executions where the image path ends with GoldenDMSA.exe and the command line contains specific wordlist/bruteforce-related arguments. The behavior matters because attackers can use GoldenDMSA tooling to target Windows directory service account operations, including password/credential-related abuse patterns. It relies on Windows process creation telemetry, including the executable filename and command-line arguments.
Reporting behind it
- github.comhttps://github.com/Semperis/GoldenDMSA
- ipurple.teamhttps://ipurple.team/2025/09/02/golden-dmsa/
- semperis.comhttps://www.semperis.com/blog/golden-dmsa-what-is-dmsa-authentication-bypass/
- thehackernews.comhttps://thehackernews.com/2025/07/critical-golden-dmsa-attack-in-windows.html
- hacktricks.wikihttps://hacktricks.wiki/en/windows-hardening/active-directory-methodology/golden-dmsa-gmsa.html
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_goldendmsa.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows HackTool Execution: GoldenDMSA.exe Launch with Directory Manipulation Parameters"
id: ce08ca9e-c9ac-4a0f-a9bc-d5a35fea5108
status: experimental
description: This rule flags process executions where the image path ends with GoldenDMSA.exe and the command line contains specific wordlist/bruteforce-related arguments. The behavior matters because attackers can use GoldenDMSA tooling to target Windows directory service account operations, including password/credential-related abuse patterns. It relies on Windows process creation telemetry, including the executable filename and command-line arguments.
references:
- https://github.com/Semperis/GoldenDMSA
- https://ipurple.team/2025/09/02/golden-dmsa/
- https://www.semperis.com/blog/golden-dmsa-what-is-dmsa-authentication-bypass/
- https://thehackernews.com/2025/07/critical-golden-dmsa-attack-in-windows.html
- https://hacktricks.wiki/en/windows-hardening/active-directory-methodology/golden-dmsa-gmsa.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_goldendmsa.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2026-10-19
tags:
- attack.persistence
- attack.privilege-escalation
- attack.t1098
- attack.credential-access
- attack.t1110.001
- attack.t1558.003
logsource:
category: process_creation
product: windows
detection:
selection_img:
Image|endswith: \GoldenDMSA.exe
selection_cli:
CommandLine|contains:
- wordlist
- bruteforce
CommandLine|contains|all:
- " -s "
- S-1-5-21-
- " -d "
- " -k "
condition: 1 of selection_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: c41ec561-872d-469b-847c-1653ad19b45d
type: derived