When Good Accounts Go Bad: Exploiting Delegated Managed Service Accounts in Active Directory

This Unit 42 report analyzes 'BadSuccessor', a Windows Server 2025-specific privilege escalation technique that lets an attacker who can create or modify delegated Managed Service Accounts (dMSAs) impersonate superseded accounts — including domain administrators — by setting dMSA attributes to simulate a completed migration. The report documents PoC tools (SharpSuccessor, Pentest-Tools module), demonstrates follow-on abuse with tools like Rubeus, maps detection footprints to event IDs (4662, 5136, 5137, 2946) and provides XDR/Windows audit-based detection queries and mitigation guidance.