Informational Rule for BadSuccessor AD Vulnerability

[joe.dibley]

Added already into a GitHub beta build. See the announcement here.

New Research: dMSA Accounts and BadSuccessor

Hi there everyone! Just wanted to let you all know about some new research that came out in the AD Security space just yesterday. There is a new attack vector in Active Directory where an attacker could abuse basic “Create all child objects” or specifically the create dMSA permission to create and use a Delegated Managed Service Account (dMSA) to compromise the secrets (password hashes) of any account in the domain. This research was built on some previous research I did on how to extract dMS…