Detection of Active Directory Account Management via PowerShell

Adversaries often attempt to maintain persistent access to compromised environments by creating or modifying domain-level security principals. In Active Directory environments, this can be achieved using the System.DirectoryServices.AccountManagement .NET namespace within PowerShell scripts. This technique allows attackers to bypass standard administrative tools and interact directly with the directory service. Detection of this activity relies on monitoring PowerShell Script Block Logging for the instantiation or usage of these specific .NET classes. While legitimate administrative scripts and infrastructure-as-code automation may utilize these libraries for routine identity management, unauthorized or unexpected usage of these classes by non-standard processes is a significant indicator of potential persistence establishment or account privilege escalation.

Impact

Successful manipulation of Active Directory security principals allows attackers to create backdoor accounts, modify group memberships for privilege escalation, or reset credentials for existing service accounts. This compromises the integrity of the domain identity infrastructure and grants attackers a durable foothold that survives credential rotations or reboots of individual member servers.

Recommendation

• Enable PowerShell Script Block Logging (Event ID 4104) across all domain controllers and member servers to capture the necessary script execution telemetry.
• Deploy the provided Sigma rule to detect the invocation of DirectoryServices.AccountManagement classes and tune the output to baseline authorized administrative service accounts.
• Audit Active Directory event logs (specifically Event IDs 4720, 4722, 4728) in conjunction with PowerShell telemetry to verify the legitimacy of account management operations occurring within the network.