Attack Tool Computer Account Creation Activity

An attacker runs tools such as the Impacket addcomputer.py Python script or the Powermad.ps1 PowerShell module to programmatically send an LDAP request with the addRequest method to a victim server. This method contains a specific set of attributes required by the DC to create a new, attacker-controlled computer account. This type of LDAP request typically exploits the default Machine Account Quota (MAQ) setting, which controls how many accounts non-administrative users can create. After the malicious account is created, the attacker sends subsequent LDAP requests with the modifyRequest method to add the rogue account to the trust list of the victim server. The attacker now controls a valid, fake computer account that expands their foothold within the network.