Password Change on Directory Service Restore Mode (DSRM) Account

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•1•0•22

Detects attempts to change the password of the Directory Services Restore Mode (DSRM) administrator account. This account is a local administrator account on Domain Controllers, and attackers may modify its password to establish persistence or elevate privileges.