MITRE ATT&CK technique · Persistence

`T1136.002` Domain Account

Adversaries may create a domain account to maintain access to victim systems. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover user, administrator, and service accounts. With a sufficient level of access, the net user /add /domain command can be…

MITRE ATT&CK page ↗

Who uses it · with stories on Jábega

HAFNIUM

Sigma rules to hunt it

PSEXEC Remote Execution File Artefacthightest · windows
Suspicious Windows ANONYMOUS LOGON Local Account Createdhightest · windows
Manipulation of User Computer or Group Security Principals Across ADmediumtest · windows

Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.