PowerShell dMSA Service Account Creation in Target OUs via New-ADServiceAccount

Alerts on PowerShell creating a delegated service account via New-ADServiceAccount with -CreateDelegatedServiceAccount and -path.

FreeReviewedSigma · Medium · v2

Product: windows
Category: ps_script
Author: Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2025-05-24
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Initial Access → Defense Evasion

Recon
Resource Dev
Initial Access
- T1078.002Domain Accounts
Execution
Persistence
- T1078.002Domain Accounts
- T1098Account Manipulation
Priv Esc
- T1078.002Domain Accounts
- T1098Account Manipulation
Defense Evasion
- T1078.002Domain Accounts
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags PowerShell activity where a script block contains New-ADServiceAccount along with -CreateDelegatedServiceAccount and -path parameters, indicating creation of a delegated managed service account in a specified OU. Attackers may abuse this account creation path to establish persistence or attempt privilege escalation in Active Directory environments. It relies on PowerShell script block text telemetry capturing the referenced cmdlet name and parameters.

Reporting behind it

Related detections9 linkedT1098 — drag to rearrange

Malicious Domain Admin Account Escalation via net group (via process_creation)

Windows: New-ADServiceAccount Creates Delegated Service Account in Target OUs

Windows PowerShell Modifies dMSA msDS-ManagedAccountPrecededByLink Attributes

Malicious Cluster-Admin Role Binding Creation (via audit)

Malicious User Password Change Using Current Hash Password - ChangeNTLM - Mimikatz (via security)

Suspicious Account Password Set to Never Expire. (via security)

Malicious Modification of a Computer Account SPN (via security)

Suspicious Massive Group Membership Changes (via security)

Malicious High Risk Active Directory Group Membership Change (via security)

PowerShell dMSA Service Account Creation in Target OUs via New-ADServiceAccount

Pivot detection · T1098 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

powershell-new-adserviceaccount-creating-delegated-service-accounts-in-specific--02122374

title: PowerShell dMSA Service Account Creation in Target OUs via New-ADServiceAccount
id: 05266d34-15f0-4f1f-a461-d470da8429d2
related:
  - id: e15bc294-ae2a-45ad-b7d6-637b33868bde
    type: similar
  - id: 0ea8db81-2ff6-4525-9448-33bbe7effc13
    type: similar
  - id: 02122374-b74e-495c-b285-9e4da973f3d6
    type: derived
status: experimental
description: This rule flags PowerShell activity where a script block contains New-ADServiceAccount along with -CreateDelegatedServiceAccount and -path parameters, indicating creation of a delegated managed service account in a specified OU. Attackers may abuse this account creation path to establish persistence or attempt privilege escalation in Active Directory environments. It relies on PowerShell script block text telemetry capturing the referenced cmdlet name and parameters.
references:
  - https://www.akamai.com/blog/security-research/abusing-bad-successor-for-privilege-escalation-in-active-directory
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_create_new_dmsasvc_account.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-05-24
tags:
  - attack.privilege-escalation
  - attack.initial-access
  - attack.persistence
  - attack.stealth
  - attack.t1078.002
  - attack.t1098
logsource:
  category: ps_script
  product: windows
detection:
  selection:
    ScriptBlockText|contains|all:
      - New-ADServiceAccount
      - -CreateDelegatedServiceAccount
      - -path
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL