New User Account Creation Attempt Via ADSI

Title: New User Account Creation Attempt Via ADSI
Status: experimental
Description:Detects an attempt to create a new user account via ADSI (Active Directory Service Interfaces) using either the WinNT or LDAP provider. This is an uncommon method to create user accounts and may indicate an attempt to evade detection by avoiding more commonly monitored commands such as "net user", "New-LocalUser" or "New-ADUser".
References:
  -https://learn.microsoft.com/en-us/windows/win32/adsi/user-creation-with-the-adsi-ldap-provider
  -https://learn.microsoft.com/en-us/windows/win32/adsi/adsi-winnt-provider
Author: William Gokah (idea), Raylee Hawkins, Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2026-08-13
modified:None
Tags:

• -'attack.persistence'
• -'attack.t1136.001'
• -'attack.t1136.002'

Logsource:

• product: windows
• category: ps_script
• definition: Requirements: Script Block Logging must be enabled

Detection:
  selection_adsi:
    ScriptBlockText|contains: '[ADSI]'
  selection_create_user:
    ScriptBlockText|contains:
      -'.create("user'
      -'.create('user'

  selection_adsi_provider:
    ScriptBlockText|contains:
      -'WinNT://'
      -'LDAP://'

  condition:all of selection_*
Falsepositives:
  -Legitimate administrative scripts that use ADSI to provision user accounts but should be rare in most environments
Level: medium