Windows HackTool Execution: GoldenDMSA.exe Launch with Directory Manipulation Parameters

ATT&CK techniques

Persistence → Cred Access

Recon
Resource Dev
Initial Access
Execution
Persistence
- T1098Account Manipulation
Priv Esc
- T1098Account Manipulation
Defense Evasion
Cred Access
- T1110.001Password Guessing
- T1558.003Kerberoasting
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags process executions where the image path ends with GoldenDMSA.exe and the command line contains specific wordlist/bruteforce-related arguments. The behavior matters because attackers can use GoldenDMSA tooling to target Windows directory service account operations, including password/credential-related abuse patterns. It relies on Windows process creation telemetry, including the executable filename and command-line arguments.

Reporting behind it

Related detections9 linkedT1098 — drag to rearrange

Windows Security: Kerberos 4771 Pre-Authentication Failures for Machine Account Password Guessing

Suspicious Compute Instance Metadata Modification in GCP

Suspicious Azure AD Authentication Method Registration for Account Takeover (via azure)

Suspicious EC2 Instance Connect SSH Public Key Push (via cloudtrail)

Possible Kerberoasting via RC4 Service Ticket Requests

Suspicious Okta Application Self-Assignment to All Applications by UNC3944 (via cloud)

Malicious Active Directory ACL Manipulation via PowerView

Suspicious dMSA Membership Modification via msDS-GroupMSAMembership Attribute

Suspicious LDAP Query Enumerating Kerberos Preauth Disabled Accounts with Whitespace Evasion

Windows HackTool Execution: GoldenDMSA.exe Launch with Directory Manipulation Parameters

Pivot detection · T1098 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-hacktool-execution-goldendmsa-exe-launch-with-directory-manipulation-par-c41ec561

title: "Windows HackTool Execution: GoldenDMSA.exe Launch with Directory Manipulation Parameters"
id: ce08ca9e-c9ac-4a0f-a9bc-d5a35fea5108
status: experimental
description: This rule flags process executions where the image path ends with GoldenDMSA.exe and the command line contains specific wordlist/bruteforce-related arguments. The behavior matters because attackers can use GoldenDMSA tooling to target Windows directory service account operations, including password/credential-related abuse patterns. It relies on Windows process creation telemetry, including the executable filename and command-line arguments.
references:
  - https://github.com/Semperis/GoldenDMSA
  - https://ipurple.team/2025/09/02/golden-dmsa/
  - https://www.semperis.com/blog/golden-dmsa-what-is-dmsa-authentication-bypass/
  - https://thehackernews.com/2025/07/critical-golden-dmsa-attack-in-windows.html
  - https://hacktricks.wiki/en/windows-hardening/active-directory-methodology/golden-dmsa-gmsa.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_goldendmsa.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2026-10-19
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1098
  - attack.credential-access
  - attack.t1110.001
  - attack.t1558.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith: \GoldenDMSA.exe
  selection_cli:
    CommandLine|contains:
      - wordlist
      - bruteforce
    CommandLine|contains|all:
      - " -s "
      - S-1-5-21-
      - " -d "
      - " -k "
  condition: 1 of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: c41ec561-872d-469b-847c-1653ad19b45d
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL