---
id: 5788
title: "BadSuccessor: How to Detect and Mitigate dMSA Privilege Escalation"
source_domain: semperis.com
source_url: "https://www.semperis.com/blog/badsuccessor-how-to-detect-mitigate-dmsa-privilege-escalation/"
published_at: "2025-06-05T13:34:47Z"
tags: ["active-directory", "privilege-escalation", "detection", "indicators-of-compromise", "directory-services-protector", "dmsa", "badsuccessor"]
phying_url: "https://phying.com/item/5788"
lang: en
---

# BadSuccessor: How to Detect and Mitigate dMSA Privilege Escalation

## Summary

BadSuccessor lets attackers abuse a dMSA to impersonate any AD user, including Domain Admins, with no patch available. Semperis DSP adds an exposure indicator plus three IOCs to detect it.

## Intelligence Metadata

- **Sources:** semperis.com
- **Published:** 2025-06-05T13:34:47Z
- **Original:** https://www.semperis.com/blog/badsuccessor-how-to-detect-mitigate-dmsa-privilege-escalation/
- **Phying News:** https://phying.com/item/5788