Detection of Stealthy User Account Creation via ADSI

Security researchers have identified a technique where attackers leverage Active Directory Service Interfaces (ADSI) via PowerShell to create new user accounts on Windows systems. By utilizing the WinNT or LDAP providers directly within PowerShell scripts, an attacker can programmatically interact with the directory service, allowing for user creation without triggering standard detection logic that typically monitors for binaries like net.exe or cmdlets like New-LocalUser. This approach is primarily aimed at persistence and privilege escalation, as it allows for the quiet creation of backdoor accounts. Because this method interacts directly with the underlying directory infrastructure, it is rarely observed in typical day-to-day administrative operations, making it a high-fidelity indicator of potentially malicious activity when detected.

Impact

Successful exploitation of this technique enables attackers to establish persistent access to a compromised machine or domain. By creating hidden or unmonitored accounts, adversaries can maintain a foothold, facilitate lateral movement, and escalate privileges. This method is particularly concerning because it evades common heuristic and signature-based detections focused on standard user management tools, potentially increasing the dwell time of an unauthorized actor within an enterprise environment.

Recommendation

Deploy the provided Sigma detection rule to monitor for PowerShell command-line activity utilizing ADSI interfaces for user account creation. Investigate any findings to distinguish between legitimate automated provisioning tasks and anomalous creation events.

• Deploy the Sigma rule below to your SIEM and enable logging for PowerShell command-line arguments via Sysmon Event ID 1 or native PowerShell script block logging (Event ID 4104).
• Investigate any hits in the SOC to determine if the account creation was initiated by authorized IT automation tools or unauthorized scripts.
• Baseline administrative scripts in your environment that legitimately leverage ADSI to reduce noise from the detection rule.