Rule Info
Name
HackTool - GoldenDMSA Execution
Author
Swachchhanda Shrawan Poudel (Nextron Systems)
Description
Detects execution of GoldenDMSA hacktool used for Directory Service Account manipulation.
Reference
Date
2026-10-19 00:00:00
Modified
None
Id
c41ec561-872d-469b-847c-1653ad19b45d
Tags
attack.persistence attack.privilege-escalation attack.t1098 attack.credential-access attack.t1110.001 attack.t1558.003
Type
Community Rule
Link to Public Repo
Rule History
Author
Title
Date
Commit
Swachchhanda Shrawan Poudel
Merge PR #5646 from @swachchhanda000 - Add rules to detect goldendMSA attack
2026-10-21
Scan your endpoints, forensic images or collected files with our portable scanner THOR