Detects PowerShell tool called Get-BadSuccessorOUPermissions.ps1 that helps exploit a vulnerability in Active Directory.

Hunt Hypothesis

This hunt hypothesis detects adversaries leveraging the Get-BadSuccessorOUPermissions.ps1 PowerShell tool to identify principals capable of executing BadSuccessor attacks within Active Directory, a technique often used to escalate privileges and manipulate object ownership. SOC teams should proactively search for this activity in Azure Sentinel because early identification of these permission anomalies allows for immediate remediation before attackers can exploit the vulnerability to compromise critical directory structures.

YARA Rule

rule HKTL_EXPL_WIN_PS1_BadSuccessor_May25 {
   meta:
      description = "Detects PowerShell tool called Get-BadSuccessorOUPermissions.ps1 that helps exploit a vulnerability in Active Directory. Lists every principal that can perform a BadSuccessor attack and the OUs where it holds the required permissions."
      author = "Florian Roth"
      reference = "https://www.akamai.com/blog/security-research/abusing-dmsa-for-privilege-escalation-in-active-directory"
      date = "2025-05-22"
      score = 75
      id = "4f6ff5ff-831a-520c-8bc5-6fec5e65f9de"
   strings:
      $x1 = "function Get-BadSuccessorOUPermissions" ascii wide
      $x2 = "\"0feb936f-47b3-49f2-9386-1dedc2c23765\"=\"msDS-DelegatedManagedServiceAccount\"" ascii wide
      $x3 = "CreateChild|GenericAll|WriteDACL|WriteOwner" ascii wide
   condition:
      filesize < 20MB and 1 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

References

False Positive Guidance

Here are 3-5 specific false positive scenarios for the Get-BadSuccessorOUPermissions.ps1 detection rule, including suggested filters and exclusions:

Scheduled Vulnerability Assessment Job
- Scenario: The organization runs a nightly scheduled task (e.g., via Windows Task Scheduler or a centralized tool like SolarWinds or Ansible) that executes Get-BadSuccessorOUPermissions.ps1 against the entire Active Directory forest to generate compliance reports for auditors. This job runs automatically on the Domain Controller every night at 02:00 AM under the context of a dedicated service account (e.g., svc-ad-audit).
- Filter/Exclusion: Create an exclusion rule that ignores alerts where the Process Name is powershell.exe, the Command Line contains Get-BadSuccessorOUPermissions.ps1, and the User Account matches svc-ad-audit or falls within a specific “Audit Service Accounts” group. Additionally, filter by Time Window to exclude runs between 01:30 AM and 04:00 AM on weekdays.
On-Demand Security Review by Identity Team
- Scenario: A member of the Active Directory Identity Management team (e.g., admin-id-team-01) manually launches the script from their workstation or a jumpbox to investigate a specific OU hierarchy change or to validate permissions before a major migration. This is an interactive, ad-hoc session rather than an automated exploit attempt.
- Filter/Exclusion: Implement a filter that excludes alerts originating from Source IPs belonging to the “Identity Management Jumpbox” subnet (e.g., 10.20.50.x). Alternatively, exclude any execution where the Parent Process Name is identified as an interactive terminal emulator like `k