New User Account Creation Attempt Via ADSI

 1title: New User Account Creation Attempt Via ADSI
 2id: e50d5d26-0cf6-4045-b82b-13c0a4e316be
 3related:
 4    - id: 7c9fed65-039a-4055-8c23-fa763d94aff6
 5      type: similar
 6status: experimental
 7description: |
 8    Detects an attempt to create a new user account via ADSI (Active Directory Service Interfaces)
 9    using either the WinNT or LDAP provider. This is an uncommon method to create user accounts
10    and may indicate an attempt to evade detection by avoiding more commonly monitored commands
11    such as "net user", "New-LocalUser" or "New-ADUser".    
12references:
13    - https://learn.microsoft.com/en-us/windows/win32/adsi/user-creation-with-the-adsi-ldap-provider
14    - https://learn.microsoft.com/en-us/windows/win32/adsi/adsi-winnt-provider
15author: William Gokah (idea), Raylee Hawkins, Swachchhanda Shrawan Poudel (Nextron Systems)
16date: 2026-08-13
17tags:
18    - attack.persistence
19    - attack.t1136.001
20    - attack.t1136.002
21logsource:
22    product: windows
23    category: ps_script
24    definition: 'Requirements: Script Block Logging must be enabled'
25detection:
26    selection_adsi:
27        ScriptBlockText|contains: '[ADSI]'
28    selection_create_user:
29        # Example (WinNT - local user):
30        #   $computer = [ADSI]"WinNT://localhost"; $user = $computer.Create("User", "NewUser"); $user.SetPassword("P@ssw0rd!"); $user.SetInfo()
31        # Example (LDAP - domain user):
32        #   $ou = [ADSI]"LDAP://CN=Users,DC=domain,DC=com"; $user = $ou.Create("user", "CN=NewUser"); $user.Put("sAMAccountName","NewUser"); $user.SetInfo()
33        ScriptBlockText|contains:
34            - '.create("user'
35            - ".create('user"
36    selection_adsi_provider:
37        ScriptBlockText|contains:
38            - 'WinNT://' # Local user creation via WinNT provider
39            - 'LDAP://' # Domain user creation via LDAP provider
40    condition: all of selection_*
41falsepositives:
42    - Legitimate administrative scripts that use ADSI to provision user accounts but should be rare in most environments
43level: medium
44regression_tests_path: regression_data/rules/windows/powershell/powershell_script/posh_ps_adsi_create_user/info.yml