Security ArtifactsDFIR Intelligence
SearchSign inSubscribe

T1136

Create Account

Windows · IaaS · Linux · macOS · Network Devices · Containers · SaaS · Office Suite · Identity Provider · ESXinothing on this site yetT1136 on attack.mitre.org

Adversaries may create an account to maintain access to victim systems. With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system. Accounts may be created on the local system or within a domain or cloud tenant.

MITRE ATT&CK 19.2, retrieved 2026-09-12

If this is happening now

1

Checklists and playbooks to open while the alert is still live.

how MITRE says to see it

Detection Strategy for T1136 - Create Account across platforms

  • Adversary uses built-in OS tools or API calls to create local or domain accounts for persistence or lateral movement. Tools such as 'net user', PowerShell, or MMC snap-ins may be used. Detection focuses on Event ID 4720 paired with process lineage and user context.
  • Adversary invokes 'useradd', 'adduser', or equivalent system commands or scripts to create local users. Detection focuses on command execution and audit trail of passwd/shadow file modifications.
  • Adversary creates new users using 'dscl' commands, GUI tools, or by modifying user plist files. Detection includes monitoring dscl invocation and user-related plist changes.
  • Adversary creates users via IAM/IdP API or portal (e.g., Azure AD, Okta). Detection involves monitoring API calls, admin action logs, and correlation with role assignments.

what reduces it

  • M1028 Operating System Configuration. Protect domain controllers by ensuring proper security configuration for critical servers.
  • M1030 Network Segmentation. Configure access controls and firewalls to limit access to domain controllers and systems used to create and manage accounts.
  • M1026 Privileged Account Management. Limit the number of accounts with permissions to create other accounts. Do not allow domain administrator accounts to be used for day-to-day operations that may expose them to potential adversaries on unprivileged systems.
  • M1032 Multi-factor Authentication. Use multi-factor authentication for user and privileged accounts.

sub-techniques

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.