Splunk SPL Queries for Detecting gMSA Attacks

This blog post demonstrates simulated attacks against Active Directory group Managed Service Accounts (gMSA)—including reading `msDS-ManagedPassword`/`msDS-ManagedPasswordId` and harvesting the KDS Root Key—and provides Splunk SPL queries, Windows Event ID guidance (e.g., `4662`, `2946`, `4624`), and SACL auditing recommendations to detect and investigate these techniques.