TLDR Tech / InfoSec
dMSA Ouroboros: Self-Sustaining Credential Extraction in Windows Server 2025
Huntress detailed a six-command persistence technique against fully patched Windows Server 2025 in which a low-privilege user with CreateChild on any OU and WriteProperty on a target account creates a delegated Managed Service Account (dMSA), takes ownership to grant itself GenericAll, plants a Shadow Credential on msDS-KeyCredentialLink for PKINIT authentication, and writes the dMSA's own SID into msDS-GroupMSAMembership, so it authorizes itself to extract the superseded account's NT hash. The chain survives password rotation (PKINIT bypasses the managed password and the KDC repopulates the hash on every S4U2Self request), survives deletion of the original attacker account, and can lock Domain Admins out of remediation by writing a restrictive membership descriptor. Defenders should hunt for any dMSA whose own SID appears in its GroupMSAMembership, audit msDS-KeyCredentialLink writes on dMSA objects, monitor Event IDs 5136, 4662, and 4768 for PKINIT against dMSAs, and treat full deletion of the rogue dMSA as the only effective fix since Microsoft closed the report as a persistence technique that does not meet the servicing bar.
Read the full story