New User Account Creation Attempt Via ADSI in CommandLine

title: New User Account Creation Attempt Via ADSI in CommandLine
id: 7c9fed65-039a-4055-8c23-fa763d94aff6
related:
    - id: e50d5d26-0cf6-4045-b82b-13c0a4e316be
      type: similar
status: experimental
description: |
    Detects PowerShell command line arguments containing ADSI (Active Directory Service Interfaces) patterns
    trying to create a new user account via the WinNT or LDAP provider. This is an uncommon method to create
    user accounts and may indicate an attempt to evade detection by avoiding more commonly monitored commands
    such as "net user", "New-LocalUser" or "New-ADUser".
references:
    - https://learn.microsoft.com/en-us/windows/win32/adsi/user-creation-with-the-adsi-ldap-provider
    - https://learn.microsoft.com/en-us/windows/win32/adsi/adsi-winnt-provider
author: William Gokah (idea), Raylee Hawkins, Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2026-08-13
tags:
    - attack.persistence
    - attack.t1136.001
    - attack.t1136.002
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith:
              - '\powershell.exe'
              - '\pwsh.exe'
        - OriginalFileName:
              - 'PowerShell.EXE'
              - 'pwsh.dll'
    selection_cli_adsi:
        CommandLine|contains: '[ADSI]'
    selection_cli_create_user:
        # Example (WinNT - local user):
        #   powershell.exe -Command "$c = [ADSI]('WinNT://' + $env:COMPUTERNAME); $u = $c.Create('User','NewUser'); $u.SetPassword('P@ssw0rd!'); $u.SetInfo()"
        # Example (LDAP - domain user):
        #   $ou = [ADSI]"LDAP://CN=Users,DC=domain,DC=com"; $user = $ou.Create("user", "CN=NewUser"); $user.Put("sAMAccountName","NewUser"); $user.SetInfo()
        CommandLine|contains:
            - '.Create("user'
            - ".Create('user"
    selection_cli_adsi_provider:
        CommandLine|contains:
            - 'WinNT://' # Local user creation via WinNT provider
            - 'LDAP://' # Domain user creation via LDAP provider
    condition: all of selection_*
falsepositives:
    - Legitimate administrative scripts that use ADSI to provision user accounts but should be rare in most environments
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_powershell_adsi_create_user/info.yml