Suspicious Manipulation of User Computer or Group Security Principals Across AD (via ps_script)

title: Suspicious Manipulation of User Computer or Group Security Principals Across AD (via ps_script)
id: 9094bca3-e63b-536c-9100-d590f4d79e73
status: stable
description: This rule detects threat actors may create a domain account to maintain access to victim systems. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain..
references:
    - https://attack.mitre.org/techniques/T1136/002/
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1136.002/T1136.002.md#atomic-test-3---create-a-new-domain-account-using-powershell
    - https://learn.microsoft.com/en-us/dotnet/api/system.directoryservices.accountmanagement?view=net-8.0
author: Huntrule Team
date: 2026-01-19
tags:
    - attack.persistence
    - attack.t1136.002
logsource:
    product: windows
    category: ps_script
    definition: 'Requirements: Script Block Logging must be enabled'
detection:
    selection:
        ScriptBlockText|contains: System.DirectoryServices.AccountManagement
    condition: selection
falsepositives:
    - Unknown
level: medium