Sigma rule: Potential KDS Root Key Access on Windows System

Rule

Title

Potential KDS Root Key Access on Windows System

Status

experimental

Level

medium

Author

Panos Gkatziroulis, Swachchhanda Shrawan Poudel (Nextron Systems)

Date

2026-10-19

File

rules-placeholder/windows/builtin/security/win_security_kds_root_key_access.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects potential retrieval of KDS Root Key information from Active Directory for the purpose of conducting a Golden dMSA attack.
The Golden dMSA technique attempts to read the Master Root Keys by accessing the object type msKds-ProvRootKey.

Log source

product

windows

service

security

definition

Requirements: Audit Directory Service Access auditing should be enabled. Monitoring of KDS Root Keys requires creating a System Access Control List (SACL) for the associated object. Enable auditing for objects attempting to Read or Write properties for the principal group "Everyone" on msKds-ProvRootKey object types.

Detection

selection:
    # This rule should be applied after initial baselining according your environment.
    EventID: 4662
    ObjectType|contains: 'aa02fd41-17e0-4f18-8687-b2239649736b' # msKds-ProvRootKey
    AccessMask:
        - '0x100' # Control Access
        - '0x10' # Read Property
filter:
    SubjectUserName|expand: '%Domain_Controller%' # Exclude DC computer accounts who are expected to read this object
condition: selection and not filter

False positives (as the rule lists them)

• Legitimate administrative activities

Tags

• attack.credential-access
• attack.t1003.006
• attack.t1558.003
• attack.t1558.004

MITRE ATT&CK ids this rule names

• T1003.006
• T1558.003
• T1558.004

References

• https://learn.microsoft.com/en-us/windows/win32/adschema/c-mskds-provrootkey
• https://ipurple.team/2025/09/02/golden-dmsa/
• https://www.semperis.com/blog/golden-dmsa-what-is-dmsa-authentication-bypass/
• https://github.com/MicrosoftDocs/SupportArticles-docs/blob/ed7cab329190354c13deaa07ea15b6165bbd32fd/support/windows-server/windows-security/recover-from-golden-gmsa-attack.md
• https://threatlabsnews.xcitium.com/blog/golden-dmsa-attack-one-flaw-in-windows-server-2025-threatens-entire-active-directory-forests

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-placeholder/windows/builtin/security/win_security_kds_root_key_access.yml