{"id":4054,"date":"2025-05-19T10:03:27","date_gmt":"2025-05-19T10:03:27","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2025\/05\/19\/abusing-dmsa-with-advanced-active-directory-persistence-techniques\/"},"modified":"2025-05-19T10:03:27","modified_gmt":"2025-05-19T10:03:27","slug":"abusing-dmsa-with-advanced-active-directory-persistence-techniques","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2025\/05\/19\/abusing-dmsa-with-advanced-active-directory-persistence-techniques\/","title":{"rendered":"Abusing dMSA with Advanced Active Directory Persistence Techniques\u00a0"},"content":{"rendered":"

Abusing dMSA with Advanced Active Directory Persistence Techniques\u00a0
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

Delegated Managed Service Accounts (dMSAs), introduced in Windows Server 2025, represent Microsoft\u2019s latest innovation in secure service account management.\u00a0<\/p>\n

While designed to enhance security by preventing traditional credential theft attacks like Kerberoasting, security researchers have uncovered potential abuse vectors that could allow attackers to establish persistent access in Active Directory<\/a> environments.\u00a0<\/p>\n

dMSAs were created to solve long-standing problems with traditional service accounts. Unlike standard accounts that require manual password management, dMSAs provide automatic credential management and link authentication directly to machine identities.<\/p>\n

According to Microsoft documentation, \u201cdMSA is a more secure and manageable approach to service account management compared to traditional service accounts\u201d.<\/p>\n

The technology allows administrators to migrate from conventional service accounts<\/a> while disabling the original account\u2019s password authentication, redirecting all requests through the Local Security Authority (LSA) using the new dMSA mechanism.\u00a0<\/p>\n

This feature was specifically designed to eliminate credential theft risks.<\/p>\n

The Persistence Vector<\/strong><\/h2>\n

According to Matan Bahar, despite enhanced security controls, dMSAs can potentially be abused by attackers who have temporarily gained elevated privileges. The attack targets the Access Control Lists (ACLs) of the dMSA objects themselves.<\/p>\n

The key vulnerability lies in the \u201cManaged Service Accounts\u201d container and its permission inheritance structure.\u00a0<\/p>\n

An attacker with domain administrator access, even temporarily, can modify ACLs to maintain access to dMSA accounts after their privileged access is revoked.<\/p>\n

The attack begins by gaining \u201cGenericAll\u201d permissions on the Managed Service Accounts container:<\/p>\n

\n
\"\"<\/figure>\n<\/div>\n

While having \u201cGenericAll\u201d permissions on the container doesn\u2019t automatically grant access to child objects, attackers can force inheritance down to all dMSA objects:<\/p>\n

\n
\"\"<\/figure>\n<\/div>\n
\n
\"\"<\/figure>\n<\/div>\n

These commands establish persistent control over all existing and future dMSA objects. The attacker can then:<\/p>\n