---
id: 5960
title: "gMSA Active Directory Attacks"
source_domain: semperis.com
source_url: "https://www.semperis.com/blog/golden-gmsa-attack/"
published_at: "2022-03-01T07:08:31Z"
tags: ["active-directory", "privilege-escalation", "detection", "gmsa", "golden-gmsa", "kds"]
phying_url: "https://phying.com/item/5960"
lang: en
---

# gMSA Active Directory Attacks

## Summary

New 'Golden GMSA' attack: attackers with high privileges can dump KDS root key attributes, then use the GoldenGMSA tool to generate any associated gMSA's password offline—no privileged account needed; detection and defense guidance included.

## Intelligence Metadata

- **Sources:** semperis.com
- **Published:** 2022-03-01T07:08:31Z
- **Original:** https://www.semperis.com/blog/golden-gmsa-attack/
- **Phying News:** https://phying.com/item/5960