New User Account Creation Attempt Via ADSI

Status: experimental
Severity: medium
Log source: category ps_script, product windows
Author: William Gokah (idea), Raylee Hawkins, Swachchhanda Shrawan Poudel (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects an attempt to create a new user account via ADSI (Active Directory Service Interfaces) using either the WinNT or LDAP provider. This is an uncommon method to create user accounts and may indicate an attempt to evade detection by avoiding more commonly monitored commands such as "net user", "New-LocalUser" or "New-ADUser".

Known false positives

Legitimate administrative scripts that use ADSI to provision user accounts but should be rare in most environments

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1136.001` Create Account: Local Account `T1136.002` Create Account: Domain Account

Telemetry coverage

Provider	Record / event type
PowerShell	Event ID 4104: Creating Scriptblock text (MessageNumber of MessageTotal).

Rule body

title: New User Account Creation Attempt Via ADSI
id: e50d5d26-0cf6-4045-b82b-13c0a4e316be
related:
    - id: 7c9fed65-039a-4055-8c23-fa763d94aff6
      type: similar
status: experimental
description: |
    Detects an attempt to create a new user account via ADSI (Active Directory Service Interfaces)
    using either the WinNT or LDAP provider. This is an uncommon method to create user accounts
    and may indicate an attempt to evade detection by avoiding more commonly monitored commands
    such as "net user", "New-LocalUser" or "New-ADUser".
references:
    - https://learn.microsoft.com/en-us/windows/win32/adsi/user-creation-with-the-adsi-ldap-provider
    - https://learn.microsoft.com/en-us/windows/win32/adsi/adsi-winnt-provider
author: William Gokah (idea), Raylee Hawkins, Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2026-08-13
tags:
    - attack.persistence
    - attack.t1136.001
    - attack.t1136.002
logsource:
    product: windows
    category: ps_script
    definition: 'Requirements: Script Block Logging must be enabled'
detection:
    selection_adsi:
        ScriptBlockText|contains: '[ADSI]'
    selection_create_user:
        # Example (WinNT - local user):
        #   $computer = [ADSI]"WinNT://localhost"; $user = $computer.Create("User", "NewUser"); $user.SetPassword("P@ssw0rd!"); $user.SetInfo()
        # Example (LDAP - domain user):
        #   $ou = [ADSI]"LDAP://CN=Users,DC=domain,DC=com"; $user = $ou.Create("user", "CN=NewUser"); $user.Put("sAMAccountName","NewUser"); $user.SetInfo()
        ScriptBlockText|contains:
            - '.create("user'
            - ".create('user"
    selection_adsi_provider:
        ScriptBlockText|contains:
            - 'WinNT://' # Local user creation via WinNT provider
            - 'LDAP://' # Domain user creation via LDAP provider
    condition: all of selection_*
falsepositives:
    - Legitimate administrative scripts that use ADSI to provision user accounts but should be rare in most environments
level: medium
regression_tests_path: regression_data/rules/windows/powershell/powershell_script/posh_ps_adsi_create_user/info.yml

Stages and Predicates

Stage 0: `condition`

all of selection_*

Stage 1: `selection_adsi`

selection_adsi:
    ScriptBlockText|contains: '[ADSI]'

Stage 2: `selection_create_user`

selection_create_user:
    ScriptBlockText|contains:
        - '.create("user'
        - ".create('user"

Stage 3: `selection_adsi_provider`

selection_adsi_provider:
    ScriptBlockText|contains:
        - 'WinNT://'
        - 'LDAP://'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ScriptBlockText`	match	`.create("user` `.create('user` `LDAP://` `WinNT://` `[ADSI]`	`field:"ScriptBlockText" kind:match`