Detection proposal: dMSA (BadSuccessor) abuse via predecessor link without superseded-account link

Abierto
  • ¿Algo no está bien?
#4,384 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
22/100
Tipo de issue
Nueva funcionalidad
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
yaml
Área
security

Línea de trabajo

Start with the two proposed analytics: a TTP on Security 5136/5137 that correlates msDS-ManagedAccountPrecededByLink with msDS-SupersededManagedAccountLink by DN, and an Anomaly on 5137 with ObjectClass msDS-DelegatedManagedServiceAccount. Check with maintainers first whether these fit under Active Directory Privilege Escalation, since the proposal is still open. Done means both analytics build with contentctl-ng and pass against the attached lab dataset.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

enhancement

Detection proposal: dMSA (BadSuccessor) abuse via predecessor link without superseded-account link

Gap. security_content has no analytics for delegated Managed Service Accounts (dMSA, Windows Server 2025), so BadSuccessor (CVE-2025-53779) is not covered. Elastic alerts on any write to msDS-ManagedAccountPrecededByLink, which also fires on every legitimate migration.

Proposal. Two experimental analytics on Security 5136/5137:

  • Windows AD dMSA Predecessor Link Without Superseded Account Link (TTP): msDS-ManagedAccountPrecededByLink is written on a dMSA, but no matching msDS-SupersededManagedAccountLink is written on that predecessor. The two changes are correlated by DN, in either order.
  • Windows AD dMSA Object Creation (Anomaly): 5137 with ObjectClass msDS-DelegatedManagedServiceAccount.

Evidence. Windows Server 2025 (build 26100) lab DC. Microsoft's Start-/Complete-ADServiceAccountMigration writes both sides of the link: on the dMSA, and on the predecessor (msDS-SupersededManagedAccountLink, msDS-SupersededServiceAccountState). A direct predecessor-link write, the BadSuccessor primitive, changes only the dMSA. An attacker abusing BadSuccessor has no rights over the privileged predecessor, so they cannot add the second side. The lab data (49 events) gives 1/1 for the TTP: the direct write is detected and the legitimate migration is not. The Anomaly gives 2/2, with no hits on the gMSA or user creations. contentctl-ng build passes.

Would these fit under Active Directory Privilege Escalation? I can open the PR and publish the dataset to attack_data. Related: #4382, #4383.

Lenguaje dominante
Python
Estrellas
1.7k
Forks
503
Merge medio
2 d 11 h
PR fusionados (30 d)
43

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de splunk/security_content

Todos los issues de splunk/security_content

Issues similares

Más issues de Python

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.