Repository navigation
fix(analysis): Refine dMSA post-processing conditions (#3529) - #3583
Draft
adilalperenciftci wants to merge 2 commits into
Draft
adilalperenciftci wants to merge 2 commits into
adilalperenciftci wants to merge 2 commits into
Conversation
…ssor, OuroborosSelfEnroll, DMSAPrecededBy edges BloodHound-side modeling for delegated MSA abuse (dMSA Ouroboros / BadSuccessor, CVE-2025-53779): new DMSA node kind, ingest-time CreateDMSA ACL edge, post-processed BadSuccessor (principal -> Domain) and OuroborosSelfEnroll edges, and the structural DMSAPrecededBy edge; PostBadSuccessor/PostOuroborosSelfEnroll wired into Post(). Schema-registration unit test. SharpHound collection + ein ingest + serial_integration behavioral tests follow in a companion PR. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Contributor
|
Important Draft PR not reviewedDraft PRs are not automatically reviewed by default.
To automatically review draft PRs, update your CodeRabbit configuration: reviews:
auto_review:
drafts: true
Comment |
|
All contributors have signed the CLA ✍️ ✅ |
This was referenced Oct 25, 2026
Draft
Author
|
recheck |
1 similar comment
Author
|
recheck |
Author
|
I have read the CLA Document and I hereby sign the CLA |
Author
|
recheck |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
#3529 derives a domain-level
BadSuccessorrelationship fromCreateDMSAwithout distinguishing domain controller patch state. That overstates reachability on fully patched domains, where the analysis must also establish write access to both victim attributes. The dMSA relationships are also missing a dedicated edge-filter category, and the schema test uses the internal package despite exercising only exported symbols.Solution
I retained #3529's dMSA schema and post-processing work and made the derivation patch-aware. The analysis now uses registry-backed domain controller build and revision data, emitting the domain relationship only when a collected Windows Server 2025 controller predates build 26100.4946. Patched or unknown environments use the conservative target-specific model: the same
CreateDMSAprincipal must haveGenericAll,GenericWrite, or both attribute-specific write relationships over the victim.I added ingestion and schema support for the build evidence and the two attribute-specific relationships, grouped the four dMSA relationships under
Delegated Managed Service Accounts, and moved exported schema coverage topackage ad_test.Collector companions:
Resolves #2424.
Testing
just generatejust analyzejust showgo test -tags integration -v ./packages/go/analysis/ad -run TestDMSA -count=1 -timeout 15mgo test ./packages/go/analysis/ad/... ./packages/go/ein -count=1go vet ./packages/go/analysis/ad/...yarn workspace bh-shared-ui test run src/views/Explore/ExploreSearch/EdgeFilter/edgeCategories.test.tsx