Security ArtifactsDFIR Intelligence
SearchSign inSubscribe

T1136.002sub-technique of T1136 Create Account

Domain Account

Linux · macOS · Windowsnothing on this site yetT1136.002 on attack.mitre.org

Adversaries may create a domain account to maintain access to victim systems. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover user, administrator, and service accounts. With a sufficient level of access, the `net user /add /domain` command can be used to create a domain account.

MITRE ATT&CK 19.2, retrieved 2026-09-12

If this is happening now

1

Checklists and playbooks to open while the alert is still live.

how MITRE says to see it

T1136.002 Detection Strategy - Domain Account Creation Across Platforms

  • Adversary uses built-in tools such as 'net user /add /domain' or PowerShell to create a domain user account. The behavior chain includes: (1) suspicious process execution on a domain controller followed by (2) user account creation event (Event ID 4720) on the same host.
  • Adversary with access to domain management tools (e.g., `realmd`, `samba-tool`, `ldapmodify`) creates a new domain user via command-line utilities. Behavior chain: LDAP command or script triggers → user entry added in AD via Kerberos/LDAP traffic.
  • macOS clients joined to AD via LDAP may script account provisioning via `dsconfigad`, `dscl`, or LDAP scripts. Detection occurs when such tools run on a domain-joined system, followed by authentication attempts by a previously unseen account.

what reduces it

  • M1028 Operating System Configuration. Protect domain controllers by ensuring proper security configuration for critical servers.
  • M1030 Network Segmentation. Configure access controls and firewalls to limit access to domain controllers and systems used to create and manage accounts.
  • M1026 Privileged Account Management. Limit the number of accounts with permissions to create other accounts. Do not allow domain administrator accounts to be used for day-to-day operations that may expose them to potential adversaries on unprivileged systems.
  • M1032 Multi-factor Authentication. Use multi-factor authentication for user and privileged accounts.

the rest of T1136

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.