HackTool - GoldenDMSA Execution

Title: HackTool - GoldenDMSA Execution
Status: experimental
Description:Detects execution of GoldenDMSA hacktool used for Directory Service Account manipulation.
References:
  -https://github.com/Semperis/GoldenDMSA
  -https://ipurple.team/2025/09/02/golden-dmsa/
  -https://www.semperis.com/blog/golden-dmsa-what-is-dmsa-authentication-bypass/
  -https://thehackernews.com/2025/07/critical-golden-dmsa-attack-in-windows.html
  -https://hacktricks.wiki/en/windows-hardening/active-directory-methodology/golden-dmsa-gmsa.html
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2026-10-19
modified:None
Tags:

• -'attack.persistence'
• -'attack.privilege-escalation'
• -'attack.t1098'
• -'attack.credential-access'
• -'attack.t1110.001'
• -'attack.t1558.003'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
    Image|endswith: '\GoldenDMSA.exe'
  selection_cli:
    CommandLine|contains:
      -'wordlist'
      -'bruteforce'

    CommandLine|contains|all:
      -' -s '
      -'S-1-5-21-'
      -' -d '
      -' -k '

  condition:1 of selection_*
Falsepositives:
  -Unknown
Level: high