Detection rules › Elastic
dMSA Account Creation by an Unusual User
Detects the creation of a delegated Managed Service Account by an unusual subject account. Attackers can abuse the dMSA account migration feature to elevate privileges abusing weak persmission allowing users child objects rights or msDS-DelegatedManagedServiceAccount rights.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Initial Access | T1078 Valid Accounts, T1078.002 Valid Accounts: Domain Accounts |
| Persistence | T1078 Valid Accounts, T1078.002 Valid Accounts: Domain Accounts, T1098 Account Manipulation, T1136 Create Account, T1136.002 Create Account: Domain Account |
| Privilege Escalation | T1078 Valid Accounts, T1078.002 Valid Accounts: Domain Accounts, T1098 Account Manipulation |
| Defense Evasion | T1078 Valid Accounts, T1078.002 Valid Accounts: Domain Accounts |
Event coverage
| Provider | Event ID | Title |
|---|---|---|
| Security-Auditing | 5137 | A directory service object was created. |
Stages and Predicates
Stage 1: kql:new_terms
winlog.event_data.ObjectClass:"msDS-DelegatedManagedServiceAccount"Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
winlog.event_data.ObjectClass | eq |
|