CmdID / Techniques / T1136

T1136.001 Create Account: Local Account

Adversaries may create a local account to maintain access to victim systems. MITRE ATT&CK

7 Sigma rules T1136.001 on attack.mitre.org

Part of

MITRE ATT&CK

T1136Create Account

Sigma rules tagged with it

process creation, the highest levels first

criticalServ-U Exploitation CVE-2021-35211 by DEV-0322Florian Roth (Nextron Systems) · Windows

highDarkGate - User Created Via Net.EXEX__Junior (Nextron Systems) · Windows

highNew User Created Via Net.EXE With Never Expire OptionNasreddine Bencherchali (Nextron Systems) · Windows

highUser Added to Remote Desktop Users GroupFlorian Roth (Nextron Systems) · Windows

mediumNew User Account Creation Attempt Via ADSI in CommandLineWilliam Gokah (idea), Raylee Hawkins, Swachchhanda Shrawan Poudel (Nextron Systems) · Windows

mediumNew User Created Via Net.EXEEndgame, JHasenbusch (adapted to Sigma for oscd.community) · Windows

lowCreation Of A Local User AccountAlejandro Ortuno, oscd.community · macOS

Command lines CmdID reads as it

everyday examples from tldr-pages, CC BY 4.0

Add a user to the local security group (run in elevated console) on the page for net

net localgroup "Administrators" username /addIdentify

To add a user account for Jay Samson (user name: jays), with sign in rights from 8 AM to 5 PM, Monday through Friday, with the mandatory password Cyk4^g3B, and use the user's full name, run the following command on the page for net user

net user jays Cyk4^g3B /add /passwordreq:yes /times:monday-friday,8am-5pm /fullname:"Jay Jamison"Identify

An example is here when CmdID’s reading of it names T1136.001: a Sigma rule it trips is tagged with it, or its abuse is documented as it.