T1136.001 Local Account
Sub-technique of T1136 Create Account
Adversaries may create a local account to maintain access to victim systems. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service. For example, with a sufficient level of access, the Windows net user /add command can be used to create a local account. In Linux, the `useradd` command can be used,…
Who uses it · with stories on Jábega
Sigma rules to hunt it
- Serv-U Exploitation CVE-2021-35211 by DEV-0322criticaltest · windows
- Cisco Local Accountshightest · cisco
- Creation of a Local Hidden User Account by Registryhightest · windows
- DarkGate - User Created Via Net.EXEhightest · windows
- Hidden Local User Creationhightest · windows
- New User Created Via Net.EXE With Never Expire Optionhightest · windows
- Privileged User Has Been Createdhightest · linux
- Suspicious Windows ANONYMOUS LOGON Local Account Createdhightest · windows
- User Added to Remote Desktop Users Grouphightest · windows
- Creation Of An User Accountmediumtest · linux
- New User Created Via Net.EXEmediumtest · windows
- PowerShell Create Local Usermediumtest · windows
- FortiGate - New Administrator Account Createdmediumexperimental · fortigate
- FortiGate - New Local User Createdmediumexperimental · fortigate
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.