Detects execution of the GoldenDMSA hacktool, which is used to manipulate Directory Service Accounts (DMSA) and abuse gMSA authentication. The Sigma-style rule watches Windows process creation events and flags two patterns: (1) a process image ending with \GoldenDMSA.exe, and (2) a command line that contains wordlist or bruteforce and, collectively, the flags -s, S-1-5-21-, -d, and -k. The presence of these elements indicates attempts to enumerate or brute-force domain/gMSA-related credentials, potentially enabling privilege escalation or unauthorized access in Active Directory environments. The rule links to techniques such as credential-access and account-discovery (via DMSA/gMSA manipulation) and has ties to privilege-escalation paths. It is categorized as high severity and targets Windows process creation events. False positives are not clearly defined (unknown). References provided include public write-ups and advisories on GoldenDMSA. Mitigation considerations include restricting or auditing GoldenDMSA usage, monitoring for the specific executable path and suspicious command-line patterns, and enforcing application allowlisting and stronger AD governance to detect and interrupt DMSA-related abuse.