attack.t1078.002

Admin User Remote Logon

Apr 28, 2026 · attack.privilege-escalation attack.persistence attack.lateral-movement attack.initial-access attack.stealth attack.t1078.001 attack.t1078.002 attack.t1078.003 car.2016-04-005 ·

Share on:

Detect remote login by Administrator user (depending on internal pattern).

DMSA Link Attributes Modified

Apr 28, 2026 · attack.privilege-escalation attack.persistence attack.initial-access attack.stealth attack.t1078.002 attack.t1098 ·

Share on:

Detects modification of dMSA link attributes (msDS-ManagedAccountPrecededByLink) via PowerShell scripts. This command line pattern could be an indicator an attempt to exploit the BadSuccessor privilege escalation vulnerability in Windows Server 2025.

DMSA Service Account Created in Specific OUs - PowerShell

Apr 28, 2026 · attack.privilege-escalation attack.initial-access attack.persistence attack.stealth attack.t1078.002 attack.t1098 ·

Share on:

Detects the creation of a dMSA service account using the New-ADServiceAccount cmdlet in certain OUs. The fact that the cmdlet is used to create a dMSASvc account in a specific OU is highly suspicious. It is a pattern trying to exploit the BadSuccessor privilege escalation vulnerability in Windows Server 2025. On top of that, if the user that is creating the dMSASvc account is not a legitimate administrator or does not have the necessary permissions, it is a strong signal of an attempted or successful abuse of the BaDSuccessor vulnerability for privilege escalation within the Windows Server 2025 Active Directory environment.

Malicious Usage Of IMDS Credentials Outside Of AWS Infrastructure

Apr 28, 2026 · attack.privilege-escalation attack.initial-access attack.persistence attack.stealth attack.t1078 attack.t1078.002 ·

Share on:

Detects when an instance identity has taken an action that isn't inside SSM. This can indicate that a compromised EC2 instance is being used as a pivot point.

New DMSA Service Account Created in Specific OUs

Apr 28, 2026 · attack.privilege-escalation attack.initial-access attack.persistence attack.stealth attack.t1078.002 attack.t1098 ·

Share on:

Detects the creation of a dMSASvc account using the New-ADServiceAccount cmdlet in certain OUs. The fact that the Cmdlet is used to create a dMSASvc account in a specific OU is highly suspicious. It is a pattern trying to exploit the BadSuccessor privilege escalation vulnerability in Windows Server 2025. On top of that, if the user that is creating the dMSASvc account is not a legitimate administrator or does not have the necessary permissions, it is a strong signal of an attempted or successful abuse of the BaDSuccessor vulnerability for privilege escalation within the Windows Server 2025 Active Directory environment.