title: Potential KDS Root Key Access on Windows System
id: 5f0d5e5a-61d1-44cd-900d-2df14ffe4f82
status: experimental
description: |
Detects potential retrieval of KDS Root Key information from Active Directory for the purpose of conducting a Golden dMSA attack.
The Golden dMSA technique attempts to read the Master Root Keys by accessing the object type msKds-ProvRootKey.
references:
- https://learn.microsoft.com/en-us/windows/win32/adschema/c-mskds-provrootkey
- https://ipurple.team/2025/09/02/golden-dmsa/
- https://www.semperis.com/blog/golden-dmsa-what-is-dmsa-authentication-bypass/
- https://github.com/MicrosoftDocs/SupportArticles-docs/blob/ed7cab329190354c13deaa07ea15b6165bbd32fd/support/windows-server/windows-security/recover-from-golden-gmsa-attack.md
- https://threatlabsnews.xcitium.com/blog/golden-dmsa-attack-one-flaw-in-windows-server-2025-threatens-entire-active-directory-forests
author: Panos Gkatziroulis, Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2026-10-19
tags:
- attack.credential-access
- attack.t1003.006
- attack.t1558.003
- attack.t1558.004
logsource:
product: windows
service: security
definition: |
Requirements: Audit Directory Service Access auditing should be enabled.
Monitoring of KDS Root Keys requires creating a System Access Control List (SACL) for the associated object.
Enable auditing for objects attempting to Read or Write properties for the principal group "Everyone" on msKds-ProvRootKey object types.
detection:
selection:
# This rule should be applied after initial baselining according your environment.
EventID: 4662
ObjectType|contains: 'aa02fd41-17e0-4f18-8687-b2239649736b' # msKds-ProvRootKey
AccessMask:
- '0x100' # Control Access
- '0x10' # Read Property
filter:
SubjectUserName|expand: '%Domain_Controller%' # Exclude DC computer accounts who are expected to read this object
condition: selection and not filter
falsepositives:
- Legitimate administrative activities
level: medium