BadSuccessor (DMSA, 2025) → instant Domain Admin

§ Context

Assumed environment: at least one DC is Server 2025 and a delegation exists letting an attacker create or modify a DMSA in any OU.

§ Steps

1. 01
   Principal w/ Create-Child rights in an OUInitial Access

   T1078— Valid Accounts
2. 02
   DCSync as DACredential Access

   T1003.006— DCSync
3. 03
   Set msDS-ManagedAccountPrecededByLink → DAPrivilege Escalation

   AD-BADSUCCESSOR— BadSuccessor (DMSA, 2025)
4. 04
   Create a DMSA in that OUPrivilege Escalation

   AD-BADSUCCESSOR— BadSuccessor (DMSA, 2025)

   New-ADServiceAccount -DelegatedManagedServiceAccount …

5. 05
   Authenticate as the DMSALateral Movement

   AD-DMSA— Delegated Managed Service Account Auth

   Inherits the predecessor's group memberships and SIDs in its TGT.

§ References

• T1078Valid Accounts
• T1003.006DCSync

§ Frequently asked

What is the "BadSuccessor (DMSA, 2025) → instant Domain Admin" attack path?

Server 2025's Delegated Managed Service Accounts inherit the powers of any account listed in msDS-ManagedAccountPrecededByLink — letting an OU-admin escalate to DA without any patch chain. It chains 5 steps drawn from real-world offensive-security techniques.

What starting position does this attack require?

The first step is Principal w/ Create-Child rights in an OU (T1078) — a initial access primitive. Assumed environment: at least one DC is Server 2025 and a delegation exists letting an attacker create or modify a DMSA in any OU.

What is the final impact of this kill-chain?

The final step lands on Authenticate as the DMSA (AD-DMSA), which falls under Lateral Movement. From here, an operator typically pivots into post-exploitation or maintains persistence.

How can defenders detect or prevent this attack?

Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers

• Shared techniques2

  mitm6 IPv6 SLAAC → NTLM relay → DA

  Even when IPv4 is hardened, Windows clients prefer IPv6 with default DHCPv6. mitm6 makes the attacker the IPv6 DNS server, advertises wpad, and relays the captured NTLM to LDAPS for RBCD.

• Shared techniques2

  PetitPotam + ADCS ESC8 → Domain Controller takeover

  Coerce a DC's machine account to authenticate to the attacker, relay that NTLM to the ADCS HTTP web-enrollment endpoint, and obtain a DC certificate for full domain compromise.

• Shared techniques2

  noPac / sAMAccountName spoofing → Domain Admin

  Combine CVE-2021-42278 (sAMAccountName validation) and CVE-2021-42287 (PAC confusion) to impersonate a DC as a low-priv user.

• Shared techniques2

  Unconstrained delegation → Capture DC TGT → DCSync

  Compromise a host with TRUSTED_FOR_DELEGATION, coerce a DC to authenticate to it, harvest the DC's TGT from its LSASS, then DCSync.

• Shared techniques2

  ADCS ESC1 → Domain Admin

  A low-priv domain user discovers a certificate template that lets enrollees supply an arbitrary subjectAltName, enrolls a cert as Administrator, and authenticates via PKINIT.

• Shared techniques2

  GenericWrite on Domain Admins → AddMember → DA

  A misconfigured 'member' attribute write on a privileged group lets the attacker silently add themselves as a Domain Admin.