Group Managed Service Accounts password dump - GoldenGMSA

Status: experimental
Severity: high
Log source: product windows, service security
Author: mdecrevoisier
Source: github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker attempts to dump Group Managed Services account (GMSA) passwords stored on writable domain controllers.

Known false positives

None

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1003` OS Credential Dumping

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 4662: An operation was performed on an object.

Rule body

title: Group Managed Service Accounts password dump - GoldenGMSA
description: Detects scenarios where an attacker attempts to dump Group Managed Services account (GMSA) passwords stored on writable domain controllers.
correlation: correlate TargetLogonId from ID 4624 with SubjectLogonId from ID 4662 to identify the source of the dump.
requirements: extended rights auditing enabled
references:
- https://www.semperis.com/blog/golden-gmsa-attack/
- https://twitter.com/cnotin/status/1498952017263353858?t=PX9bWqa2SZLOZnpXbOScUg&s=09
tags:
- attack.credential_access
- attack.t1003
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4662
    ObjectServer: DS
    ObjectType: msKds-ProvRootKey
  filter:
    SubjectUserSid: 'S-1-5-18'
  condition: selection and not filter
falsepositives:
- None
level: high

Stages and Predicates

Stage 0: `condition`

selection and not filter

Stage 1: `selection`

selection:
  EventID: 4662
  ObjectServer: DS
  ObjectType: msKds-ProvRootKey

Stage 2: `not filter`

filter:
  SubjectUserSid: 'S-1-5-18'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`SubjectUserSid`	eq	`S-1-5-18`	`excludes:SubjectUserSid` `field:"SubjectUserSid" value:"S-1-5-18"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ObjectServer`	eq	`DS` corpus 3 (sigma 3)	`field:"ObjectServer" kind:eq value:"DS"`
`ObjectType`	eq	`msKds-ProvRootKey`	`field:"ObjectType" kind:eq value:"msKds-ProvRootKey"`