ADTRADE-007: BadSuccessor dMSA Migration Escalation Surface
- Plataforma
- Active Directory
- Categoría
- AD Adversary Tradecraft Indicators
- Severidad
- Critical
- Pilar de Zero Trust
- Identity (peso 2)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Windows Server 2025 introduced delegated Managed Service Accounts (dMSA, object class msDS-DelegatedManagedServiceAccount) with a migration feature: a dMSA can be marked as superseding an existing account, after which it inherits that account's privileges and Kerberos keys. The 2024-disclosed 'BadSuccessor' technique abuses this: a principal that can merely CREATE a dMSA in an OU (CreateChild on the dMSA class, or broad write/GenericAll over the OU) can create one, point it at a privileged account, and inherit its keys — escalating to that account without ever holding rights over it directly. This check inventories OUs where a non-Tier-0 principal holds that capability.
Valor recomendado
No non-Tier-0 principal can create or write a delegated MSA (msDS-DelegatedManagedServiceAccount) in any OU.
Remediación
On each flagged OU, remove CreateChild (for the msDS-DelegatedManagedServiceAccount class), GenericAll, WriteDacl, and WriteOwner from non-administrative principals. Audit delegated OU permissions broadly — the same ACEs that enable BadSuccessor also enable other object-creation abuses. Until patched/mitigated, monitor creation of msDS-DelegatedManagedServiceAccount objects (4662/5137 events). This check SKIPs on forests whose schema predates Server 2025.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-6, AC-3
- ANSSI
- vuln1_delegation_dmsa
- CIS AD Benchmark
- 6.3.1
- MITRE ATT&CK
- T1098, T1078.002