PowerShell Script Manipulating Active Directory Security Principals

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•14

This rule detects the use of `System.DirectoryServices.AccountManagement` within PowerShell script block logs. This .NET namespace is commonly used to programmatically manage Active Directory security principals such as users, computers, and groups. Adversaries may use this method to create new domain accounts, modify existing ones, or manipulate group memberships to establish persistence or elevate privileges within an Active Directory environment.