Sigma rule: New MsDS-DelegatedManagedServiceAccount (DMSA) Object Created

Rule

Title

New MsDS-DelegatedManagedServiceAccount (DMSA) Object Created

Status

experimental

Level

medium

Author

Swachchhanda Shrawan Poudel (Nextron Systems)

Date

2025-05-24

File

rules-placeholder/windows/builtin/security/win_security_msds_dmsa_object_creation.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the creation of new msDS-DelegatedManagedServiceAccount objects, which could indicate potential abuse of privilege escalation vulnerabilities in Windows Server 2025.
The msDS-DelegatedManagedServiceAccount (DMSA) is a new object class introduced in Windows Server 2025 that allows administrators to delegate the management of service accounts to other users or groups.
Attackers may exploit this feature to create unauthorized service accounts with elevated privileges, leading to privilege escalation within the Active Directory environment.
It is highly suspicious if an msDS-DelegatedManagedServiceAccount object is created without proper authorization or in an unexpected context, such as by a non-administrative user or outside of normal administrative workflows.
So, it's a good idea to look out for accounts that are not typically responsible for service account creation to detect potential abuse of this feature.

Log source

product

windows

service

security

definition

Requirements: Audit Policy : Account Management > Audit User Account Management, Group Policy : Computer Configuration\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Account Management\Audit User Account Management, DS Access > Audit Directory Service Changes, Group Policy : Computer Configuration\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\DS Access\Audit Directory Service Changes

Detection

selection:
    EventID: 5137
    ObjectClass: 'msDS-DelegatedManagedServiceAccount'
filter_main_legitimate_accounts:
    # Exclude modifications made by the system or legitimate administrative accounts
    - SubjectAccountName: 'SYSTEM'
    - SubjectAccountName|expand: '%Administrators%' # Add all members of the Administrators group to this placeholder
condition: selection and not 1 of filter_main_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.privilege-escalation
• attack.initial-access
• attack.persistence
• attack.stealth
• attack.t1078.002
• attack.t1098

MITRE ATT&CK ids this rule names

• T1078.002
• T1098

Related rules

• 02122374-b74e-495c-b285-9e4da973f3d6 (similar)
• 0ea8db81-2ff6-4525-9448-33bbe7effc13 (similar)

References

• https://www.akamai.com/blog/security-research/abusing-dmsa-for-privilege-escalation-in-active-directory

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-placeholder/windows/builtin/security/win_security_msds_dmsa_object_creation.yml