New User Account Creation Attempt Via ADSI in CommandLine
Detects PowerShell command line arguments containing ADSI (Active Directory Service Interfaces) patterns trying to create a new user account via the WinNT or LDAP provider. This is an uncommon method to create user accounts and may indicate an attempt to evade detection by avoiding more commonly monitored commands such as "net user", "New-LocalUser" or "New-ADUser".
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.
detection:
selection_img:
- Image|endswith:
- '\powershell.exe'
- '\pwsh.exe'
- OriginalFileName:
- 'PowerShell.EXE'
- 'pwsh.dll'
selection_cli_adsi:
CommandLine|contains: '[ADSI]'
selection_cli_create_user:
# Example (WinNT - local user):
# powershell.exe -Command "$c = [ADSI]('WinNT://' + $env:COMPUTERNAME); $u = $c.Create('User','NewUser'); $u.SetPassword('P@ssw0rd!'); $u.SetInfo()"
# Example (LDAP - domain user):
# $ou = [ADSI]"LDAP://CN=Users,DC=domain,DC=com"; $user = $ou.Create("user", "CN=NewUser"); $user.Put("sAMAccountName","NewUser"); $user.SetInfo()
CommandLine|contains:
- '.Create("user'
- ".Create('user"
selection_cli_adsi_provider:
CommandLine|contains:
- 'WinNT://' # Local user creation via WinNT provider
- 'LDAP://' # Domain user creation via LDAP provider
condition: all of selection_*Legitimate administrative scripts that use ADSI to provision user accounts but should be rare in most environments
Tactics
Sub-techniques