New User Account Creation Attempt Via ADSI in CommandLine

 1title: New User Account Creation Attempt Via ADSI in CommandLine
 2id: 7c9fed65-039a-4055-8c23-fa763d94aff6
 3related:
 4    - id: e50d5d26-0cf6-4045-b82b-13c0a4e316be
 5      type: similar
 6status: experimental
 7description: |
 8    Detects PowerShell command line arguments containing ADSI (Active Directory Service Interfaces) patterns
 9    trying to create a new user account via the WinNT or LDAP provider. This is an uncommon method to create
10    user accounts and may indicate an attempt to evade detection by avoiding more commonly monitored commands
11    such as "net user", "New-LocalUser" or "New-ADUser".    
12references:
13    - https://learn.microsoft.com/en-us/windows/win32/adsi/user-creation-with-the-adsi-ldap-provider
14    - https://learn.microsoft.com/en-us/windows/win32/adsi/adsi-winnt-provider
15author: William Gokah (idea), Raylee Hawkins, Swachchhanda Shrawan Poudel (Nextron Systems)
16date: 2026-08-13
17tags:
18    - attack.persistence
19    - attack.t1136.001
20    - attack.t1136.002
21logsource:
22    category: process_creation
23    product: windows
24detection:
25    selection_img:
26        - Image|endswith:
27              - '\powershell.exe'
28              - '\pwsh.exe'
29        - OriginalFileName:
30              - 'PowerShell.EXE'
31              - 'pwsh.dll'
32    selection_cli_adsi:
33        CommandLine|contains: '[ADSI]'
34    selection_cli_create_user:
35        # Example (WinNT - local user):
36        #   powershell.exe -Command "$c = [ADSI]('WinNT://' + $env:COMPUTERNAME); $u = $c.Create('User','NewUser'); $u.SetPassword('P@ssw0rd!'); $u.SetInfo()"
37        # Example (LDAP - domain user):
38        #   $ou = [ADSI]"LDAP://CN=Users,DC=domain,DC=com"; $user = $ou.Create("user", "CN=NewUser"); $user.Put("sAMAccountName","NewUser"); $user.SetInfo()
39        CommandLine|contains:
40            - '.Create("user'
41            - ".Create('user"
42    selection_cli_adsi_provider:
43        CommandLine|contains:
44            - 'WinNT://' # Local user creation via WinNT provider
45            - 'LDAP://' # Domain user creation via LDAP provider
46    condition: all of selection_*
47falsepositives:
48    - Legitimate administrative scripts that use ADSI to provision user accounts but should be rare in most environments
49level: medium
50regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_powershell_adsi_create_user/info.yml