Windows PowerShell AD Account Management .NET Usage for Group/Computer Principal Changes

title: Windows PowerShell AD Account Management .NET Usage for Group/Computer Principal Changes
id: a0883874-d728-4671-967e-78bef6859842
status: test
description: This rule flags PowerShell script block content that includes the .NET namespace System.DirectoryServices.AccountManagement, which is commonly used to manipulate Active Directory-managed accounts. Adversaries can use this capability to create or modify domain principals to maintain access across systems and services in an Active Directory environment. The detection relies on Script Block Logging telemetry capturing the presence of the AccountManagement namespace within the executed script text.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1136.002/T1136.002.md#atomic-test-3---create-a-new-domain-account-using-powershell
  - https://learn.microsoft.com/en-us/dotnet/api/system.directoryservices.accountmanagement?view=net-8.0
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_directoryservices_accountmanagement.yml
author: frack113, Huntrule Team
date: 2021-12-28
tags:
  - attack.persistence
  - attack.t1136.002
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains: System.DirectoryServices.AccountManagement
  condition: selection
falsepositives:
  - Legitimate administrative script
level: medium
license: DRL-1.1
related:
  - id: b29a93fb-087c-4b5b-a84d-ee3309e69d08
    type: derived