Sigma rule: New User Account Creation Attempt Via ADSI in CommandLine

Rule

Title

New User Account Creation Attempt Via ADSI in CommandLine

Status

experimental

Level

medium

Author

William Gokah (idea), Raylee Hawkins, Swachchhanda Shrawan Poudel (Nextron Systems)

Date

2026-08-13

File

rules/windows/process_creation/proc_creation_win_powershell_adsi_create_user.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects PowerShell command line arguments containing ADSI (Active Directory Service Interfaces) patterns
trying to create a new user account via the WinNT or LDAP provider. This is an uncommon method to create
user accounts and may indicate an attempt to evade detection by avoiding more commonly monitored commands
such as "net user", "New-LocalUser" or "New-ADUser".

Log source

product

windows

category

process_creation

Detection

selection_img:
    - Image|endswith:
          - '\powershell.exe'
          - '\pwsh.exe'
    - OriginalFileName:
          - 'PowerShell.EXE'
          - 'pwsh.dll'
selection_cli_adsi:
    CommandLine|contains: '[ADSI]'
selection_cli_create_user:
    # Example (WinNT - local user):
    #   powershell.exe -Command "$c = [ADSI]('WinNT://' + $env:COMPUTERNAME); $u = $c.Create('User','NewUser'); $u.SetPassword('P@ssw0rd!'); $u.SetInfo()"
    # Example (LDAP - domain user):
    #   $ou = [ADSI]"LDAP://CN=Users,DC=domain,DC=com"; $user = $ou.Create("user", "CN=NewUser"); $user.Put("sAMAccountName","NewUser"); $user.SetInfo()
    CommandLine|contains:
        - '.Create("user'
        - ".Create('user"
selection_cli_adsi_provider:
    CommandLine|contains:
        - 'WinNT://' # Local user creation via WinNT provider
        - 'LDAP://' # Domain user creation via LDAP provider
condition: all of selection_*

False positives (as the rule lists them)

• Legitimate administrative scripts that use ADSI to provision user accounts but should be rare in most environments

Tags

• attack.persistence
• attack.t1136.001
• attack.t1136.002

MITRE ATT&CK ids this rule names

• T1136.001
• T1136.002

Related rules

• e50d5d26-0cf6-4045-b82b-13c0a4e316be (similar)

References

• https://learn.microsoft.com/en-us/windows/win32/adsi/user-creation-with-the-adsi-ldap-provider
• https://learn.microsoft.com/en-us/windows/win32/adsi/adsi-winnt-provider

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_powershell_adsi_create_user.yml