Detects Windows PowerShell command lines that attempt to create a new user account via ADSI (Active Directory Service Interfaces) using the WinNT:// or LDAP:// providers. The rule targets PowerShell processes (powershell.exe, pwsh.exe) and checks for ADSI usage in the CLI, specifically patterns like [ADSI], and user creation syntax such as .Create("user" or .Create('user'). It also requires the command line to reference an ADSI provider (WinNT:// or LDAP://). This combination is uncommon and can indicate attempts to evade detection by using ADSI instead of more commonly monitored commands like net user, New-LocalUser, or New-ADUser. The rule is built to fire only when all relevant conditions are met (image/process, ADSI usage, user-create invocation, and ADSI provider). False positives are possible from legitimate admin scripts that provision accounts via ADSI, but such scripts are relatively rare in most environments.