Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

New User Account Creation Attempt Via ADSI

Detects an attempt to create a new user account via ADSI (Active Directory Service Interfaces) using either the WinNT or LDAP provider. This is an uncommon method to create user accounts and may indicate an attempt to evade detection by avoiding more commonly monitored commands such as "net user", "New-LocalUser" or "New-ADUser".

ATT&CK coverage

Outside the enterprise matrix

Detection requirements

Log source product: windows
Log source category: ps_script

What the source says

What fires this without an attack behind it

Legitimate administrative scripts that use ADSI to provision user accounts but should be rare in most environments

References

Tagged by the source as

attack.persistence

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.