Techniques
Sample rules
New User Account Creation Attempt Via ADSI in CommandLine
- source: sigma
- technicques:
- t1136
- t1136.001
- t1136.002
Description
Detects PowerShell command line arguments containing ADSI (Active Directory Service Interfaces) patterns trying to create a new user account via the WinNT or LDAP provider. This is an uncommon method to create user accounts and may indicate an attempt to evade detection by avoiding more commonly monitored commands such as “net user”, “New-LocalUser” or “New-ADUser”.
Detection logic
condition: all of selection_*
selection_cli_adsi:
CommandLine|contains: '[ADSI]'
selection_cli_adsi_provider:
CommandLine|contains:
- WinNT://
- LDAP://
selection_cli_create_user:
CommandLine|contains:
- .Create("user
- .Create('user
selection_img:
- Image|endswith:
- \powershell.exe
- \pwsh.exe
- OriginalFileName:
- PowerShell.EXE
- pwsh.dll
New User Account Creation Attempt Via ADSI
- source: sigma
- technicques:
- t1136
- t1136.001
- t1136.002
Description
Detects an attempt to create a new user account via ADSI (Active Directory Service Interfaces) using either the WinNT or LDAP provider. This is an uncommon method to create user accounts and may indicate an attempt to evade detection by avoiding more commonly monitored commands such as “net user”, “New-LocalUser” or “New-ADUser”.
Detection logic
condition: all of selection_*
selection_adsi:
ScriptBlockText|contains: '[ADSI]'
selection_adsi_provider:
ScriptBlockText|contains:
- WinNT://
- LDAP://
selection_create_user:
ScriptBlockText|contains:
- .create("user
- .create('user