Full Report
A fully patched Windows Server 2025 domain is vulnerable to dMSA Ouroboros—a self-sustaining credential extraction technique requiring only standard delegated permissions. Learn how it works, why remediation fails, and how to detect it.
Analysis Summary
# Tool/Technique: dMSA Ouroboros
## Overview
dMSA Ouroboros is a self-sustaining credential extraction and persistence technique targeting Windows Server 2025. It exploits the design of delegated Managed Service Accounts (dMSAs) to create a "closed loop" where a dMSA authorizes itself to extract the NT hash of a target account. Unlike previous iterations (like BadSuccessor), Ouroboros bypasses current patches by satisfying bidirectional link requirements and remains persistent even if the original attacker's account is deleted or the target's password is changed.
## Technical Details
- **Type:** Technique (Active Directory Persistence / Credential Extraction)
- **Platform:** Windows Server 2025 (Active Directory Environments)
- **Capabilities:**
- Extracts NT hashes of target accounts (including sensitive ones).
- Persists through target password rotations.
- Self-authorizes via Shadow Credentials (msDS-KeyCredentialLink).
- Prevents remediation by Domain Admins through specific attribute locking/denial of permissions.
- **First Seen:** Publicly documented May 2026 (building on research from 2025).
## MITRE ATT&CK Mapping
- **[TA0006 - Credential Access]**
- [T1558 - Steal or Forge Kerberos Tickets]
- [T1003 - OS Credential Dumping]
- **[TA0003 - Persistence]**
- [T1098 - Account Manipulation]
- [T1098.005 - Device Registration (Shadow Credentials)]
- **[TA0005 - Defense Evasion]**
- [T1564 - Hide Artifacts]
## Functionality
### Core Capabilities
- **Bidirectional Link Creation:** Uses standard delegated permissions (`CreateChild` on an OU and `WriteProperty` on a target account) to establish the `msDS-ManagedAccountPrecededByLink` and `msDS-ManagedAccountSucceededByLink` required by the Windows Server 2025 KDC.
- **Credential Extraction:** Leverages the KDC-mediated authorization flow to receive a `KERB-DMSA-KEY-PACKAGE`, which contains the target account's NT hash.
- **Credential Requesting:** Uses the dMSA's own identity to request the "superseded" account's credentials.
### Advanced Features
- **Self-Sustaining Loop (Ouroboros):** The attacker configures the dMSA to have `WriteProperty` over its own `msDS-KeyCredentialLink` and `msDS-GroupMSAMembership` attributes. This allows the dMSA to rotate its own "Shadow Credentials" and maintain its own authorization to the target without further attacker intervention.
- **Anti-Remediation:** The attacker can modify the dMSA's Security Descriptor to deny `WriteProperty` or `Delete` permissions to Domain Admins, effectively locking the malicious account in the directory.
- **Orphaned Persistence:** Once the loop is closed, the original attacker account can be deleted, but the dMSA continues to function and extract credentials.
## Indicators of Compromise
- **File Hashes:** N/A (Technique-based, though specific scripts like `dmsa-tool.ps1` may be used).
- **Registry Keys:** N/A.
- **Network Indicators:** Kerberos traffic involving `AS-REQ` and `TGS-REQ` with dMSA-specific extensions (PA-DATA types related to dMSA).
- **Behavioral Indicators:**
- Unexpected creation of `msDS-DMSA` objects in OUs.
- Modifications to the `msDS-ManagedAccountSucceededByLink` attribute on high-value accounts.
- Self-modification of `msDS-KeyCredentialLink` or `msDS-GroupMSAMembership` by a dMSA account.
- ACE (Access Control Entry) additions that explicitly `DENY` Domain Admins access to specific AD objects.
## Associated Threat Actors
- No specific named groups identified; currently documented by security researchers (Huntress, Akamai, Semperis).
## Detection Methods
- **Behavioral Detection:** Monitor for the `4662` event (An operation was performed on an object) specifically targeting the `msDS-ManagedAccountSucceededByLink` attribute.
- **Audit Logs:** Monitor for the creation of new `msDS-DMSA` object classes.
- **Directory Search:** Periodically query for dMSA accounts where the `msDS-GroupMSAMembership` contains the dMSA's own SID.
- **SIEM Rules:** Alert on any user outside of Domain Admins modifying attributes on sensitive service accounts or administrative users.
## Mitigation Strategies
- **Least Privilege:** Restrict `CreateChild` permissions on OUs and `WriteProperty` permissions on sensitive user/service accounts.
- **GPO/Policy:** Limit which accounts can be designated as "superseded" by dMSAs.
- **Active Directory Hardening:** Regularly audit the `msDS-KeyCredentialLink` attribute for all accounts to identify unauthorized Shadow Credentials.
- **Monitoring:** Implement strict monitoring for Windows Server 2025-specific Kerberos extensions.
## Related Tools/Techniques
- **BadSuccessor:** The predecessor technique involving one-sided link manipulation.
- **Golden dMSA:** A technique involving the compromise of the KDS root key.
- **Shadow Credentials:** The underlying mechanism used by Ouroboros for self-authentication.
- **gMSA (Group Managed Service Accounts):** The older version of managed service accounts which Ouroboros improves upon (from an attacker perspective).