This rule detects an attempt to create a new user account via ADSI (Active Directory Service Interfaces) in Windows PowerShell scripts by examining ScriptBlock logs. ADSI can manage directory services through providers such as WinNT or LDAP. Adversaries may use ADSI to provision accounts in a way that avoids monitoring of more common commands (for example, net user, New-LocalUser, or New-ADUser). The detector requires all three conditions to be met within the same script block: (1) an ADSI indicator ([ADSI]) in ScriptBlockText, (2) a user creation action via ADSI (.create("user" or .create('user')), and (3) an ADSI provider reference (WinNT:// or LDAP://). If all conditions are present, the rule triggers an alert. The logsource notes Windows with a PS_script category and mandates that Script Block Logging be enabled to provide the script contents. The rule is labeled experimental with a medium severity. False positives may occur from legitimate admin automation that provisions accounts via ADSI. Operators should correlate with identity and provisioning events, monitor for unusual ADSI usage, and enforce controls like ScriptBlockLogging and least-privilege AD management to reduce risk of account creation abuse. Regression/test data paths are provided in the metadata to validate rule behavior during updates.