gMSA Password Read

A gMSA (Group Managed Service Account) is a service account whose password Active Directory manages and rotates automatically. That password lives in the object's msDS-ManagedPassword attribute, and AD lets the principals listed in msDS-GroupMSAMembership read it. If we compromise one of those principals (or an ACL lets us write that attribute), we can recover the blob, derive the account's NT hash and use it, often with high privileges.

BloodHound marks this relationship with the ReadGMSAPassword edge. Extraction is direct:

python3 gMSADumper.py -u <user> -p <pass> -d <domain> -l <dc-ip>
netexec ldap <dc> -u <user> -p <pass> --gmsa

The output yields the gMSA$ account's NT hash, ready for Pass-the-Hash or for Kerberoasting if it also has an SPN. From Windows, Get-ADServiceAccount with -Properties msDS-ManagedPassword and the DSInternals utilities (ConvertFrom-ADManagedPasswordBlob) do the same.

How to detect it. The signature is an LDAP read of the msDS-ManagedPassword attribute by a principal that is not the expected service (event 4662 on the gMSA object with the password property), and LDAP queries against msDS-GroupMSAMembership. Correlating with later use of the gMSA$ account from an unusual host gives the abuse away.

Defence. Restrict msDS-GroupMSAMembership only to the hosts running the service, audit who can read msDS-ManagedPassword, and watch group memberships that grant that read transitively. It is a case of ACL abuse surfaced by BloodHound and feeds domain credential hunting.