Detectionmediumexperimental

New User Account Creation Attempt Via ADSI

Detects an attempt to create a new user account via ADSI (Active Directory Service Interfaces) using either the WinNT or LDAP provider. This is an uncommon method to create user accounts and may indicate an attempt to evade detection by avoiding more commonly monitored commands such as "net user", "New-LocalUser" or "New-ADUser".

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

William Gokah, Raylee Hawkins, Swachchhanda Shrawan Poudel (Nextron Systems)Created Thu Aug 13e50d5d26-0cf6-4045-b82b-13c0a4e316bewindows

Log Source

WindowsPowerShell Script

ProductWindows← raw: windows

CategoryPowerShell Script← raw: ps_script

Definition

Requirements: Script Block Logging must be enabled

Detection Logic

detection:
    selection_adsi:
        ScriptBlockText|contains: '[ADSI]'
    selection_create_user:
        # Example (WinNT - local user):
        #   $computer = [ADSI]"WinNT://localhost"; $user = $computer.Create("User", "NewUser"); $user.SetPassword("P@ssw0rd!"); $user.SetInfo()
        # Example (LDAP - domain user):
        #   $ou = [ADSI]"LDAP://CN=Users,DC=domain,DC=com"; $user = $ou.Create("user", "CN=NewUser"); $user.Put("sAMAccountName","NewUser"); $user.SetInfo()
        ScriptBlockText|contains:
            - '.create("user'
            - ".create('user"
    selection_adsi_provider:
        ScriptBlockText|contains:
            - 'WinNT://' # Local user creation via WinNT provider
            - 'LDAP://' # Domain user creation via LDAP provider
    condition: all of selection_*

False Positives

Legitimate administrative scripts that use ADSI to provision user accounts but should be rare in most environments

References

Testing & Validation

Regression Tests

by Swachchhanda Shrawan Poudel (Nextron Systems)

Positive Detection Test1 matchevtx

Microsoft-Windows-Sysmon

EVTX JSON

MITRE ATT&CK

Tactics

TA0003 · Persistence

Sub-techniques

T1136.001 · Local Account T1136.002 · Domain Account

Related Rules

SimilarDetectionmedium

New User Account Creation Attempt Via ADSI in CommandLine

Detects PowerShell command line arguments containing ADSI (Active Directory Service Interfaces) patterns trying to create a new user account via the WinNT or LDAP provider. This is an uncommon method to create user accounts and may indicate an attempt to evade detection by avoiding more commonly monitored commands such as "net user", "New-LocalUser" or "New-ADUser".

Detects similar activity. Both rules may fire on overlapping events.

Rule Metadata

Rule ID

e50d5d26-0cf6-4045-b82b-13c0a4e316be

Status

experimental

Level

medium

Type

Detection

Created

Thu Aug 13

Author

William Gokah, Raylee Hawkins, Swachchhanda Shrawan Poudel (Nextron Systems)

Path

rules/windows/powershell/powershell_script/posh_ps_adsi_create_user.yml

Raw Tags

attack.persistenceattack.t1136.001attack.t1136.002

View on GitHub