SIGNATURE_BASE_HKTL_EXPL_WIN_PS1_Badsuccessor_May25

rule SIGNATURE_BASE_HKTL_EXPL_WIN_PS1_Badsuccessor_May25 : FILE
{
	meta:
		description = "Detects PowerShell tool called Get-BadSuccessorOUPermissions.ps1 that helps exploit a vulnerability in Active Directory. Lists every principal that can perform a BadSuccessor attack and the OUs where it holds the required permissions."
		author = "Florian Roth"
		id = "4f6ff5ff-831a-520c-8bc5-6fec5e65f9de"
		date = "2025-05-22"
		modified = "2026-05-15"
		reference = "https://www.akamai.com/blog/security-research/abusing-dmsa-for-privilege-escalation-in-active-directory"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/hktl_badsuccessor_helper_may25.yar#L2-L16"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		logic_hash = "a023bced4aec2b2c601088367766f42a3fcf36053c7eb92985cc7468c7cd6cb0"
		score = 75
		quality = 85
		tags = "FILE"

	strings:
		$x1 = "function Get-BadSuccessorOUPermissions" ascii wide
		$x2 = "\"0feb936f-47b3-49f2-9386-1dedc2c23765\"=\"msDS-DelegatedManagedServiceAccount\"" ascii wide
		$x3 = "CreateChild|GenericAll|WriteDACL|WriteOwner" ascii wide

	condition:
		filesize < 20MB and 1 of them
}