MaxPatrol SIEM

Detects cyberincidents that undermine cyber resilience of a company

T1136: Create Account

Adversaries may create an account to maintain access to victim systems. With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.

Accounts may be created on the local system or within a domain or cloud tenant. In cloud environments, adversaries may create accounts that only have access to specific services, which can reduce the chance of detection.

Positive Technologies products that cover the technique

MaxPatrol SIEM knowledge base

sap_java_suspicious_user_activity: PT-CR-536: SAPASJAVA_Create_account_and_login: A newly created user logged in
network_devices_compromise: PT-CR-1351: Checkpoint_Admin_Modification: Administrators were added or deleted on a Checkpoint device

Detection

IDDS0009Data source and componentProcess: Process CreationDescription

Monitor newly executed processes associated with account creation, such as net.exe

IDDS0017Data source and componentCommand: Command ExecutionDescription

Monitor executed commands and arguments for actions that are associated with account creation, such as net user or useradd

IDDS0002Data source and componentUser Account: User Account CreationDescription

Monitor for newly constructed user accounts through account audits to detect suspicious accounts that may have been created by an adversary. Collect data on account creation within a network or Windows Event ID 4720 (for when a user account is created on a Windows system and domain controller).

Mitigation

IDM1030NameNetwork SegmentationDescription

Configure access controls and firewalls to limit access to domain controllers and systems used to create and manage accounts.

IDM1028NameOperating System ConfigurationDescription

Protect domain controllers by ensuring proper security configuration for critical servers.

IDM1032NameMulti-factor AuthenticationDescription

Use multi-factor authentication for user and privileged accounts.

IDM1026NamePrivileged Account ManagementDescription

Limit the number of accounts with permissions to create other accounts. Do not allow domain administrator accounts to be used for day-to-day operations that may expose them to potential adversaries on unprivileged systems.