Elastic high stable kql
Delegated Managed Service Account Modification by an Unusual User
Detects modifications to the msDS-ManagedAccountPrecededByLink attribute of a delegated managed service account by an unusual subject account. Attackers can abuse this attribute to inherit a target account's permissions and further elevate privileges.
Detection Logic
event.code:5136 and host.os.type:"windows" and winlog.event_data.AttributeLDAPDisplayName:"msDS-ManagedAccountPrecededByLink"Field Validations
Loading…
Comments (0)
Loading comments...