Potential KDS Root Key Access on Windows System

experimentalmedium
Log-Quelle: windows · securityAutor Panos Gkatziroulis, Swachchhanda Shrawan Poudel (Nextron Systems)Datum 2026-10-19
01

Beschreibung

Was dies ist, in Kürze.

Detects potential retrieval of KDS Root Key information from Active Directory for the purpose of conducting a Golden dMSA attack. The Golden dMSA technique attempts to read the Master Root Keys by accessing the object type msKds-ProvRootKey.

02

Tags

attack.credential-accessattack.t1003.006attack.t1558.003attack.t1558.004
03

Regelquelle (YAML)

title: Potential KDS Root Key Access on Windows System
id: 5f0d5e5a-61d1-44cd-900d-2df14ffe4f82
status: experimental
description: |
    Detects potential retrieval of KDS Root Key information from Active Directory for the purpose of conducting a Golden dMSA attack.
    The Golden dMSA technique attempts to read the Master Root Keys by accessing the object type msKds-ProvRootKey.
references:
    - https://learn.microsoft.com/en-us/windows/win32/adschema/c-mskds-provrootkey
    - https://ipurple.team/2025/09/02/golden-dmsa/
    - https://www.semperis.com/blog/golden-dmsa-what-is-dmsa-authentication-bypass/
    - https://github.com/MicrosoftDocs/SupportArticles-docs/blob/ed7cab329190354c13deaa07ea15b6165bbd32fd/support/windows-server/windows-security/recover-from-golden-gmsa-attack.md
    - https://threatlabsnews.xcitium.com/blog/golden-dmsa-attack-one-flaw-in-windows-server-2025-threatens-entire-active-directory-forests
author: Panos Gkatziroulis, Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2026-10-19
tags:
    - attack.credential-access
    - attack.t1003.006
    - attack.t1558.003
    - attack.t1558.004
logsource:
    product: windows
    service: security
    definition: |
        Requirements: Audit Directory Service Access auditing should be enabled.
        Monitoring of KDS Root Keys requires creating a System Access Control List (SACL) for the associated object.
        Enable auditing for objects attempting to Read or Write properties for the principal group "Everyone" on msKds-ProvRootKey object types.
detection:
    selection:
        # This rule should be applied after initial baselining according your environment.
        EventID: 4662
        ObjectType|contains: 'aa02fd41-17e0-4f18-8687-b2239649736b' # msKds-ProvRootKey
        AccessMask:
            - '0x100' # Control Access
            - '0x10' # Read Property
    filter:
        SubjectUserName|expand: '%Domain_Controller%' # Exclude DC computer accounts who are expected to read this object
    condition: selection and not filter
falsepositives:
    - Legitimate administrative activities
level: medium
04

erkennt Techniken (3)

ATT&CK-Techniken, die dies ermöglicht oder abbildet.

05

Referenzen

Externe Belege — Patches, Meldungen, Analysen.