Windows PowerShell creates delegated service account (New-ADServiceAccount) in targeted OUs

title: Windows PowerShell creates delegated service account (New-ADServiceAccount) in targeted OUs
id: f5edaed9-2a5a-4eff-9b74-49aca45b392f
related:
  - id: e15bc294-ae2a-45ad-b7d6-637b33868bde
    type: similar
  - id: 02122374-b74e-495c-b285-9e4da973f3d6
    type: similar
  - id: 0ea8db81-2ff6-4525-9448-33bbe7effc13
    type: derived
status: experimental
description: This rule identifies PowerShell execution that runs New-ADServiceAccount with parameters indicating creation of a delegated service account and a specified path. Creating a dMSASvc account in particular Active Directory locations can be a stealthy way to establish privileged or persistent access. The detection relies on process creation telemetry capturing the PowerShell binary name and the PowerShell command line containing the New-ADServiceAccount options.
references:
  - https://www.akamai.com/blog/security-research/abusing-bad-successor-for-privilege-escalation-in-active-directory
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_create_new_dmsasvc_account.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-05-24
tags:
  - attack.privilege-escalation
  - attack.initial-access
  - attack.persistence
  - attack.stealth
  - attack.t1078.002
  - attack.t1098
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith:
        - \powershell.exe
        - \pwsh.exe
        - \powershell_ise.exe
    - OriginalFileName:
        - powershell.exe
        - pwsh.dll
        - powershell_ise.exe
  selection_cli:
    CommandLine|contains|all:
      - New-ADServiceAccount
      - -CreateDelegatedServiceAccount
      - -path
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1