Domain account created from a command line

Siemphony@siemphonymediumT1136.002unverified

AN0006 describes a domain user being created with built-in tooling and names `net user /add /domain` and PowerShell as the examples; this rule is the process-creation half of that analytic. Three ways of asking a domain controller to create a principal are covered. The net leg wants `net.exe` or `net1.exe` as the image — either can be the logged one, because net.exe re-executes itself as net1.exe with the same arguments — plus a ` user ` subcommand, an `/add` or `-add` switch and a `/domain` switch. That last switch is required rather than optional and is the whole discriminator against the local sibling T1136.001, whose rule excludes it: without `/domain`, `net user /add` writes to the local SAM. The second leg is the Active Directory module's `New-ADUser` cmdlet typed inline, and the third is `dsadd.exe` with a `user` object type, which is how a lot of in-house AD housekeeping still provisions accounts. The cmdlet and switch spellings are authored here rather than taken from MITRE, which supplies the behaviour and the tuning knobs but no query logic. Four limits are structural. Creation through the directory API rather than a shell — `New-ADUser` inside a .ps1, a module or a here-string, an ADSI or `System.DirectoryServices` call from compiled code, an LDAP add from a non-Windows host, or an identity-management connector talking to LDAP directly — produces no matching command line, and the LDAP-add and Kerberos legs of DET0003's other analytics are different log sources this rule does not attempt. MITRE's `HostRole` knob asks that this be restricted to domain controllers to cut workstation noise, but a single process-creation event carries no field saying the host is a DC, so that has to be applied as a host filter at deployment time rather than in the rule. Its `TimeWindow` and `UserContext` knobs — the 4720 account-creation record following the process within about two minutes, and whether the caller holds domain admin or only a helpdesk role — are a cross-event join and a per-identity baseline that Sigma models neither of, so the 4720 arm of AN0006 is left out and this rule matches the command-line precursor alone. Expect overlap with the published T1087.002 rule, whose net leg matches the same ` user ` plus `/domain` shape as enumeration. This rule is written in the Sysmon EventID 1 vocabulary (`Image`, `CommandLine`) that AN0006 names; an estate feeding Security 4688 instead needs `NewProcessName` mapped onto `Image` first, and 4688 needs both *Audit Process Creation* and the separate *Include command line in process creation events* policy before `CommandLine` exists at all — neither is on in a default install or in the Microsoft and CIS baselines. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0003, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((((((FolderPath endswith "\\net.exe" or FolderPath endswith "\\net1.exe") and ProcessCommandLine contains " user ") and (ProcessCommandLine contains " /add" or ProcessCommandLine contains " -add")) and (ProcessCommandLine contains " /do" or ProcessCommandLine contains " -do")) or ProcessCommandLine contains "New-ADUser") or (FolderPath endswith "\\dsadd.exe" and ProcessCommandLine contains " user"))

Splunk · SPL

Run this as a search.

index=* ((((((Image="*\\net.exe" OR Image="*\\net1.exe") AND CommandLine="* user *") AND (CommandLine="* /add*" OR CommandLine="* -add*")) AND (CommandLine="* /do*" OR CommandLine="* -do*")) OR CommandLine="*New-ADUser*") OR (Image="*\\dsadd.exe" AND CommandLine="* user*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((((((TO_LOWER(process.executable) LIKE "*\\\\net.exe" OR TO_LOWER(process.executable) LIKE "*\\\\net1.exe") AND TO_LOWER(process.command_line) LIKE "* user *") AND (TO_LOWER(process.command_line) LIKE "* /add*" OR TO_LOWER(process.command_line) LIKE "* -add*")) AND (TO_LOWER(process.command_line) LIKE "* /do*" OR TO_LOWER(process.command_line) LIKE "* -do*")) OR TO_LOWER(process.command_line) LIKE "*new-aduser*") OR (TO_LOWER(process.executable) LIKE "*\\\\dsadd.exe" AND TO_LOWER(process.command_line) LIKE "* user*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <!-- 3 rules: the Sigma condition ORs across different fields,       which one rule cannot express. Any one matching is a hit. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\net\.exe$|\\net1\.exe$)</field>    <field name="CommandLine" type="pcre2">(?i) user </field>    <field name="CommandLine" type="pcre2">(?i)( /add| -add)</field>    <field name="CommandLine" type="pcre2">(?i)( /do| -do)</field>    <description>Domain account created from a command line (1/3)</description>    <mitre>      <id>T1136.002</id>    </mitre>  </rule>   <rule id="100001" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="CommandLine" type="pcre2">(?i)New-ADUser</field>    <description>Domain account created from a command line (2/3)</description>    <mitre>      <id>T1136.002</id>    </mitre>  </rule>   <rule id="100002" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)\\dsadd\.exe$</field>    <field name="CommandLine" type="pcre2">(?i) user</field>    <description>Domain account created from a command line (3/3)</description>    <mitre>      <id>T1136.002</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: medium
Category: account_manipulation
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 0fe9cf2f-ef16-4a6d-a86a-c5893ce4db55

ATT&CKT1136.002

T1136.002Domain Account

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonaccount manipulation

account manipulationAI draft — unreviewed

01 · What this rule detects

The command-line half of AN0006: someone asking a domain controller to create a principal, using built-in tooling. Three spellings are covered — net user ... /add /domain, the New-ADUser cmdlet, and dsadd user. State the scope plainly, because the gap is large. Most domain accounts are created in a console — Active Directory Users and Computers (dsa.msc under mmc.exe) and the Active Directory Administrative Center (dsac.exe) — and neither writes a command line carrying a name, a switch or a cmdlet. Nor does an ADSI or System.DirectoryServices call from compiled code, an LDAP add from a non-Windows host, or an identity connector talking to LDAP directly. AN0006's other log source, Security 4720, covers all of them; it is absent here because it is a different logsource needing its own rule, not because MITRE's TimeWindow knob makes it unusable. The Linux (AN0007) and macOS (AN0008) analytics in the same brief are untouched.

02 · Telemetry you need

category: process_creation / product: windows, verbatim from AN0006 — Sysmon EventID 1, fields Image and CommandLine. On Security 4688 you need NewProcessName mapped onto Image, plus both Audit Process Creation and the separate Include command line in process creation events policy before CommandLine exists at all. Neither is on in a default install or in the Microsoft and CIS baselines.

03 · How the logic works

Three legs, OR-ed. The net leg ANDs four selections. selection_net_binary takes Image|endswith \net.exe or \net1.exe, because net.exe re-executes itself as net1.exe with the same arguments. selection_net_user_verb requires ' user ' spaced on both sides so net localgroup cannot collide. selection_net_add_switch takes ' /add' or ' -add', and selection_net_domain_flag requires ' /do' or ' -do' — mandatory here, and the discriminator against the local sibling T1136.001, whose rule excludes the same substring. selection_aduser_cmdlet is a bare CommandLine|contains: 'New-ADUser'. selection_dsadd_user ANDs Image|endswith: '\dsadd.exe' with CommandLine|contains: ' user'. The cmdlet and switch spellings are the pipeline's own. MITRE's knobs are HostRole, TimeWindow, UserContext and ParentProcessName; HostRole — run this on domain controllers only — has no field in a process-creation event and must be applied as a host filter at deployment.

04 · Common false positives

Identity lifecycle automation leads by a wide margin: joiner-mover-leaver connectors and HR sync jobs calling New-ADUser from a management server under a service account, one call per hire and long bursts on intake days. The rule carries no filter excluding that pair, which is why medium reads one notch generous for what shipped.
Two collisions the false positives miss. The cmdlet leg has no Image gate, so Get-Help New-ADUser, a JEA or allowlist check passing the cmdlet name as an argument, and a scheduled task named after it all match with nothing created. And selection_dsadd_user gates on ' user' with only a leading space, so dsadd computer or dsadd group with a distinguished name containing a space-then-user token matches too.
The mirror-image gap: on a domain controller /domain is unnecessary, so net user backdoor P@ss /add typed on a DC creates a domain account this rule's own discriminator excludes — and the sibling rule then files it as local. That is exactly the on-DC scenario AN0006 describes.

05 · Detection maturity

tier_1: , and it stays there until it has been run against real data — derived from a MITRE scaffold with no query logic, never executed against a log line.
tier_2: run read-only for a fortnight, rank hits by user and parent, and convert the automation accounts into the missing filter.
tier_3: correlate with the 4720 record inside MITRE's TimeWindow, so an alert means an account exists rather than that a string was typed.

Tuning & false positivesexperimental · 5 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Gate the cmdlet leg on Image|endswith \powershell.exe / \pwsh.exe and
Tighten the dsadd leg to ' user ' with both spaces.
Add the service-account and management-host filter the first false positive
Restrict deployment to domain controllers and admin workstations, which is
Build the 4720 companion — it is the only arm that sees ADUC, ADAC and the

Declared by the author

Identity lifecycle automation. Joiner-mover-leaver connectors, HR-system sync jobs and scheduled onboarding scripts call New-ADUser from a management server or a jump host under a service account, one call per new hire and in long bursts on intake days and during bulk imports. This is the highest-volume match by a wide margin, it runs with no human at the keyboard, and it is the reason this rule is scored medium rather than high — excluding that one account and host pair is where tuning starts.
Directory administrators and service desk staff creating accounts by hand. New-ADUser from an admin workstation, or net user <name> <password> /add /domain from a shell on a domain controller, is ordinary account-management work and produces an event indistinguishable from the adversary's apart from who typed it.
Service and application account provisioning during software deployment. Product installers, DBA runbooks and cluster build guides create dedicated domain service accounts as a documented prerequisite step, so an install or upgrade window emits matches with no operator intent behind them.
Legacy and migration tooling built on dsadd. AD consolidations, forest migrations and in-house housekeeping scripts still provision users with dsadd user, typically in bulk inside a maintenance window.
Test, training and lab environments. Scripts that seed a domain with hundreds of accounts for a demo, a course, a load test or a purple-team exercise will match on every account they create.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1136.002, evaluated against their process_creation events.

Share this rule

/u/siemphony/0fe9cf2f-ef16-4a6d-a86a-c5893ce4db55

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Domain account created from a command line

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it