PowerShell dMSA Service Account Creation in Target OUs via New-ADServiceAccount
Alerts on PowerShell creating a delegated service account via New-ADServiceAccount with -CreateDelegatedServiceAccount and -path.
- Product
- windows
- Category
- ps_script
- Author
- Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2025-05-24
- Updated
- 2026-07-31
ATT&CK techniques
Initial Access → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags PowerShell activity where a script block contains New-ADServiceAccount along with -CreateDelegatedServiceAccount and -path parameters, indicating creation of a delegated managed service account in a specified OU. Attackers may abuse this account creation path to establish persistence or attempt privilege escalation in Active Directory environments. It relies on PowerShell script block text telemetry capturing the referenced cmdlet name and parameters.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: PowerShell dMSA Service Account Creation in Target OUs via New-ADServiceAccount
id: 05266d34-15f0-4f1f-a461-d470da8429d2
related:
- id: e15bc294-ae2a-45ad-b7d6-637b33868bde
type: similar
- id: 0ea8db81-2ff6-4525-9448-33bbe7effc13
type: similar
- id: 02122374-b74e-495c-b285-9e4da973f3d6
type: derived
status: experimental
description: This rule flags PowerShell activity where a script block contains New-ADServiceAccount along with -CreateDelegatedServiceAccount and -path parameters, indicating creation of a delegated managed service account in a specified OU. Attackers may abuse this account creation path to establish persistence or attempt privilege escalation in Active Directory environments. It relies on PowerShell script block text telemetry capturing the referenced cmdlet name and parameters.
references:
- https://www.akamai.com/blog/security-research/abusing-bad-successor-for-privilege-escalation-in-active-directory
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_create_new_dmsasvc_account.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-05-24
tags:
- attack.privilege-escalation
- attack.initial-access
- attack.persistence
- attack.stealth
- attack.t1078.002
- attack.t1098
logsource:
category: ps_script
product: windows
detection:
selection:
ScriptBlockText|contains|all:
- New-ADServiceAccount
- -CreateDelegatedServiceAccount
- -path
condition: selection
falsepositives:
- Unknown
level: medium
license: DRL-1.1