Detection proposal: dMSA (BadSuccessor) abuse via predecessor link without superseded-account link

Aperta
  • Qualcosa non va?
#4,384 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
22/100
Tipo di issue
Funzionalità
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
yaml
Ambito
security

Direzione di ricerca

Start with the two proposed analytics: a TTP on Security 5136/5137 that correlates msDS-ManagedAccountPrecededByLink with msDS-SupersededManagedAccountLink by DN, and an Anomaly on 5137 with ObjectClass msDS-DelegatedManagedServiceAccount. Check with maintainers first whether these fit under Active Directory Privilege Escalation, since the proposal is still open. Done means both analytics build with contentctl-ng and pass against the attached lab dataset.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

enhancement

Detection proposal: dMSA (BadSuccessor) abuse via predecessor link without superseded-account link

Gap. security_content has no analytics for delegated Managed Service Accounts (dMSA, Windows Server 2025), so BadSuccessor (CVE-2025-53779) is not covered. Elastic alerts on any write to msDS-ManagedAccountPrecededByLink, which also fires on every legitimate migration.

Proposal. Two experimental analytics on Security 5136/5137:

  • Windows AD dMSA Predecessor Link Without Superseded Account Link (TTP): msDS-ManagedAccountPrecededByLink is written on a dMSA, but no matching msDS-SupersededManagedAccountLink is written on that predecessor. The two changes are correlated by DN, in either order.
  • Windows AD dMSA Object Creation (Anomaly): 5137 with ObjectClass msDS-DelegatedManagedServiceAccount.

Evidence. Windows Server 2025 (build 26100) lab DC. Microsoft's Start-/Complete-ADServiceAccountMigration writes both sides of the link: on the dMSA, and on the predecessor (msDS-SupersededManagedAccountLink, msDS-SupersededServiceAccountState). A direct predecessor-link write, the BadSuccessor primitive, changes only the dMSA. An attacker abusing BadSuccessor has no rights over the privileged predecessor, so they cannot add the second side. The lab data (49 events) gives 1/1 for the TTP: the direct write is detected and the legitimate migration is not. The Anomaly gives 2/2, with no hits on the gMSA or user creations. contentctl-ng build passes.

Would these fit under Active Directory Privilege Escalation? I can open the PR and publish the dataset to attack_data. Related: #4382, #4383.

Lingua principale
Python
Stelle
1.7k
Fork
503
Merge medio
1g 22h
PR unite (30g)
42

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di splunk/security_content

Tutte le issue di splunk/security_content

Issue simili

Altre issue su Python

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.