Domain account created from a command line

1title: Domain account created from a command line2id: 0fe9cf2f-ef16-4a6d-a86a-c5893ce4db553status: experimental4description: |5  AN0006 describes a domain user being created with built-in tooling and names6  `net user /add /domain` and PowerShell as the examples; this rule is the7  process-creation half of that analytic. Three ways of asking a domain8  controller to create a principal are covered. The net leg wants `net.exe` or9  `net1.exe` as the image — either can be the logged one, because net.exe10  re-executes itself as net1.exe with the same arguments — plus a ` user `11  subcommand, an `/add` or `-add` switch and a `/domain` switch. That last12  switch is required rather than optional and is the whole discriminator13  against the local sibling T1136.001, whose rule excludes it: without14  `/domain`, `net user /add` writes to the local SAM. The second leg is the15  Active Directory module's `New-ADUser` cmdlet typed inline, and the third is16  `dsadd.exe` with a `user` object type, which is how a lot of in-house AD17  housekeeping still provisions accounts. The cmdlet and switch spellings are18  authored here rather than taken from MITRE, which supplies the behaviour and19  the tuning knobs but no query logic.20  Four limits are structural. Creation through the directory API rather than a21  shell — `New-ADUser` inside a .ps1, a module or a here-string, an ADSI or22  `System.DirectoryServices` call from compiled code, an LDAP add from a23  non-Windows host, or an identity-management connector talking to LDAP24  directly — produces no matching command line, and the LDAP-add and Kerberos25  legs of DET0003's other analytics are different log sources this rule does not26  attempt. MITRE's `HostRole` knob asks that this be restricted to domain27  controllers to cut workstation noise, but a single process-creation event28  carries no field saying the host is a DC, so that has to be applied as a host29  filter at deployment time rather than in the rule. Its `TimeWindow` and30  `UserContext` knobs — the 4720 account-creation record following the process31  within about two minutes, and whether the caller holds domain admin or only a32  helpdesk role — are a cross-event join and a per-identity baseline that Sigma33  models neither of, so the 4720 arm of AN0006 is left out and this rule matches34  the command-line precursor alone. Expect overlap with the published T1087.00235  rule, whose net leg matches the same ` user ` plus `/domain` shape as36  enumeration. This rule is written in the Sysmon EventID 1 vocabulary (`Image`,37  `CommandLine`) that AN0006 names; an estate feeding Security 4688 instead38  needs `NewProcessName` mapped onto `Image` first, and 4688 needs both *Audit39  Process Creation* and the separate *Include command line in process creation40  events* policy before `CommandLine` exists at all — neither is on in a default41  install or in the Microsoft and CIS baselines.42  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0003, not hand-written and not tested by its author. Any lab result is on this rule's own page.43references:44  - https://attack.mitre.org/techniques/T1136/00245  - https://attack.mitre.org/detectionstrategies/DET000346author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)47date: 2026-08-1648tags:49  - attack.persistence50  - attack.t1136.00251logsource:52  category: process_creation53  product: windows54detection:55  selection_net_binary:56    Image|endswith:57      - '\net.exe'58      - '\net1.exe'59  selection_net_user_verb:60    CommandLine|contains: ' user '61  selection_net_add_switch:62    CommandLine|contains:63      - ' /add'64      - ' -add'65  selection_net_domain_flag:66    CommandLine|contains:67      - ' /do'68      - ' -do'69  selection_aduser_cmdlet:70    CommandLine|contains: 'New-ADUser'71  selection_dsadd_user:72    Image|endswith: '\dsadd.exe'73    CommandLine|contains: ' user'74  condition: (selection_net_binary and selection_net_user_verb and selection_net_add_switch and selection_net_domain_flag) or selection_aduser_cmdlet or selection_dsadd_user75falsepositives:76  - "Identity lifecycle automation. Joiner-mover-leaver connectors, HR-system sync jobs and scheduled onboarding scripts call New-ADUser from a management server or a jump host under a service account, one call per new hire and in long bursts on intake days and during bulk imports. This is the highest-volume match by a wide margin, it runs with no human at the keyboard, and it is the reason this rule is scored medium rather than high — excluding that one account and host pair is where tuning starts."77  - "Directory administrators and service desk staff creating accounts by hand. New-ADUser from an admin workstation, or net user <name> <password> /add /domain from a shell on a domain controller, is ordinary account-management work and produces an event indistinguishable from the adversary's apart from who typed it."78  - "Service and application account provisioning during software deployment. Product installers, DBA runbooks and cluster build guides create dedicated domain service accounts as a documented prerequisite step, so an install or upgrade window emits matches with no operator intent behind them."79  - "Legacy and migration tooling built on dsadd. AD consolidations, forest migrations and in-house housekeeping scripts still provision users with dsadd user, typically in bulk inside a maintenance window."80  - "Test, training and lab environments. Scripts that seed a domain with hundreds of accounts for a demo, a course, a load test or a purple-team exercise will match on every account they create."81level: medium