T1136.001sub-technique of T1136 Create Account
Local Account
Containers · ESXi · Linux · macOS · Network Devices · Windowsnothing on this site yetT1136.001 on attack.mitre.org
Adversaries may create a local account to maintain access to victim systems. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service. For example, with a sufficient level of access, the Windows `net user /add` command can be used to create a local account.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Playbook for this stage
Suspicious execution on an endpoint
An EDR alert, an unexplained process, or a user reporting something odd.
how MITRE says to see it
T1136.001 Detection Strategy - Local Account Creation Across Platforms
- Adversary uses built-in tools like 'net user /add', PowerShell, or WMI to create a local user. Sequence: Account creation event (4720) follows process creation of a suspicious executable (e.g., powershell.exe or net.exe).
- Local user accounts are created via binaries like 'useradd', 'adduser', or by editing passwd/shadow. Behavior chain includes execution of user management binaries or modification of user database files.
- Account creation using 'dscl -create' or via GUI tools. Detection involves command execution and file changes to the local directory services database.
- Account created using esxcli commands. Sequence includes esxcli execution and successful modification to account DB.
what reduces it
- M1026 Privileged Account Management. Limit the number of accounts permitted to create other accounts. Limit the usage of local administrator accounts to be used for day-to-day operations that may expose them to potential adversaries.
- M1032 Multi-factor Authentication. Use multi-factor authentication for user and privileged accounts.