PowerShell: New-ADServiceAccount Creating Delegated Service Accounts in Specific AD OUs

Alerts on PowerShell creating a delegated service account via New-ADServiceAccount with -CreateDelegatedServiceAccount and -path.

FreeUnreviewedSigmamediumv1

powershell-new-adserviceaccount-creating-delegated-service-accounts-in-specific--02122374

title: "PowerShell: New-ADServiceAccount Creating Delegated Service Accounts in Specific AD OUs"
id: 05266d34-15f0-4f1f-a461-d470da8429d2
related:
  - id: e15bc294-ae2a-45ad-b7d6-637b33868bde
    type: similar
  - id: 0ea8db81-2ff6-4525-9448-33bbe7effc13
    type: similar
  - id: 02122374-b74e-495c-b285-9e4da973f3d6
    type: derived
status: experimental
description: This rule flags PowerShell script content that calls New-ADServiceAccount with -CreateDelegatedServiceAccount and a -path value, indicating a delegated service account is being created in an Active Directory OU. Attackers may use delegated service accounts to establish persistence and position for further privilege escalation or stealthy access. The detection relies on PowerShell ScriptBlock telemetry matching these command parameters within script execution.
references:
  - https://www.akamai.com/blog/security-research/abusing-bad-successor-for-privilege-escalation-in-active-directory
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_create_new_dmsasvc_account.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-05-24
tags:
  - attack.privilege-escalation
  - attack.initial-access
  - attack.persistence
  - attack.stealth
  - attack.t1078.002
  - attack.t1098
logsource:
  category: ps_script
  product: windows
detection:
  selection:
    ScriptBlockText|contains|all:
      - New-ADServiceAccount
      - -CreateDelegatedServiceAccount
      - -path
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1

What it detects

This rule flags PowerShell script content that calls New-ADServiceAccount with -CreateDelegatedServiceAccount and a -path value, indicating a delegated service account is being created in an Active Directory OU. Attackers may use delegated service accounts to establish persistence and position for further privilege escalation or stealthy access. The detection relies on PowerShell ScriptBlock telemetry matching these command parameters within script execution.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.