Manipulation of User Computer or Group Security Principals Across AD

Title: Manipulation of User Computer or Group Security Principals Across AD
Status: test
Description:Adversaries may create a domain account to maintain access to victim systems. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain..
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1136.002/T1136.002.md#atomic-test-3---create-a-new-domain-account-using-powershell
  -https://learn.microsoft.com/en-us/dotnet/api/system.directoryservices.accountmanagement?view=net-8.0
Author: frack113
Date: 2021-12-28
modified:None
Tags:

• -'attack.persistence'
• -'attack.t1136.002'

Logsource:

• product: windows
• category: ps_script
• definition: Requirements: Script Block Logging must be enabled

Detection:
  selection:
    ScriptBlockText|contains: 'System.DirectoryServices.AccountManagement'
  condition:selection
Falsepositives:
  -Legitimate administrative script
Level: medium