Sigma rule: New User Account Creation Attempt Via ADSI

Rule

Title

New User Account Creation Attempt Via ADSI

Status

experimental

Level

medium

Author

William Gokah (idea), Raylee Hawkins, Swachchhanda Shrawan Poudel (Nextron Systems)

Date

2026-08-13

File

rules/windows/powershell/powershell_script/posh_ps_adsi_create_user.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects an attempt to create a new user account via ADSI (Active Directory Service Interfaces)
using either the WinNT or LDAP provider. This is an uncommon method to create user accounts
and may indicate an attempt to evade detection by avoiding more commonly monitored commands
such as "net user", "New-LocalUser" or "New-ADUser".

Log source

product

windows

category

ps_script

definition

Requirements: Script Block Logging must be enabled

Detection

selection_adsi:
    ScriptBlockText|contains: '[ADSI]'
selection_create_user:
    # Example (WinNT - local user):
    #   $computer = [ADSI]"WinNT://localhost"; $user = $computer.Create("User", "NewUser"); $user.SetPassword("P@ssw0rd!"); $user.SetInfo()
    # Example (LDAP - domain user):
    #   $ou = [ADSI]"LDAP://CN=Users,DC=domain,DC=com"; $user = $ou.Create("user", "CN=NewUser"); $user.Put("sAMAccountName","NewUser"); $user.SetInfo()
    ScriptBlockText|contains:
        - '.create("user'
        - ".create('user"
selection_adsi_provider:
    ScriptBlockText|contains:
        - 'WinNT://' # Local user creation via WinNT provider
        - 'LDAP://' # Domain user creation via LDAP provider
condition: all of selection_*

False positives (as the rule lists them)

• Legitimate administrative scripts that use ADSI to provision user accounts but should be rare in most environments

Tags

• attack.persistence
• attack.t1136.001
• attack.t1136.002

MITRE ATT&CK ids this rule names

• T1136.001
• T1136.002

Related rules

• 7c9fed65-039a-4055-8c23-fa763d94aff6 (similar)

References

• https://learn.microsoft.com/en-us/windows/win32/adsi/user-creation-with-the-adsi-ldap-provider
• https://learn.microsoft.com/en-us/windows/win32/adsi/adsi-winnt-provider

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/powershell/powershell_script/posh_ps_adsi_create_user.yml