Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

When Good Accounts Go Bad: Exploiting Delegated Managed Service Accounts in Active Directory

Summary: Unit 42 detailed a technique called BadSuccessor that lets an attacker with sufficient privileges compromise an Active Directory domain by creating a delegated Managed Service Account (dMSA) and altering a small set of its attributes to mimic a completed migration, a path introduced with Windows Server 2025. No patch exists for the issue at the time of writing, and public tools including Akamai's Get-BadSuccessorOUPermissions.ps1, SharpSuccessor, and a Pentest-Tools-Collection module already automate the enumeration and exploitation steps.

Key Takeaway: Any domain user holding Create all child objects or msDS-DelegatedManagedServiceAccount permissions on an organizational unit could potentially compromise the entire domain, and the article notes that after the technique succeeds, a low-privileged account like test_weak could reach the C$ share on the domain controller, which requires Domain Admin privileges.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Detection & Response
Related
YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026