T1136.001: Local Account
Adversaries may create a local account to maintain access to victim systems. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service.
For example, with a sufficient level of access, the Windows net user /add
command can be used to create a local account. On macOS systems the dscl -create
command can be used to create a local account. Local accounts may also be added to network devices, often via common Network Device CLI commands such as username
, or to Kubernetes clusters using the kubectl
utility.
Such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
Positive Technologies products that cover the technique
MaxPatrol SIEM knowledge base
mongo_database: PT-CR-526: MongoDB_Create_Root_User: An attempt to create an account of the "root" type mongo_database: PT-CR-525: MongoDB_Create_High_Role_User: An attempt to create a privileged account enterprise_1c_and_bitrix: PT-CR-672: Enterprise_1C_Create_User_Without_Password: A user account without a password was created vulnerabilities: PT-CR-2293: CVE_2024_27198_TeamCity_Authentication_Bypass: Exploitation of vulnerability CVE-2024-27198 in TeamCity. The vulnerability allows an attacker to bypass authentication to create a new TeamCity user with administrator permissions or access token for a user. This can be used to remotely execute commands. vulnerabilities: PT-CR-1983: Possible_CVE_2023_20198_Cisco_IOS_XE: Possible exploitation of vulnerability CVE-2023-20198 in Cisco IOS XE associated with privilege escalation by creating a new administrator account mitre_attck_execution: PT-CR-1908: Execute_Over_WER_Service: Attackers can exploit a WER service vulnerability that allows spoofing an executable file and running an attackers' file with system privileges unix_mitre_attck_persistence: PT-CR-1668: Unix_User_Creation: An account was created with specification of its type and use of suspicious arguments in the account creation command web_servers_abnormal_activity: PT-CR-1974: Web_Servers_Abnormal_Activity_Persistence_Via_User_Creation: An attacker can create a new user account and act using the account to gain persistence in the system mitre_attck_persistence: PT-CR-259: Account_Created_On_Local_System: An attempt was detected to create a local or domain account and add it to the local administrators group mitre_attck_persistence: PT-CR-264: Add_New_User_In_Commandline: An attempt to create an account using the command line or PowerShell is detected mitre_attck_persistence: PT-CR-260: Fast_Create_And_Delete_Account: An attempt to create and delete an account in a short period of time is detected sap_suspicious_user_activity: PT-CR-232: SAPASABAP_Critical_Action_By_Non_Admin_User: A non admin user performed a critical action in the system clickhouse: PT-CR-1574: ClickHouse_Create_User_With_Plaintext_Password: An attempt to create a user with an unencrypted password is detected clickhouse: PT-CR-1581: ClickHouse_Create_User_Without_Password: An attempt to create a user without a password is detected apache_cassandra_database: PT-CR-2088: Apache_Cassandra_Create_Superuser_Role: Attempt to create a superuser role. This may indicate an attacker trying to hide their activity using a new account with root privileges. vk_cloud: PT-CR-2305: VK_Cloud_Critical_DB_Operation: An untrusted user performed an operation with a critical database in VK Cloud. Attackers can bypass protection or gain persistence in the system by changing or deleting a critical database, or creating its backup or a new user in it. These operations allow attackers to access sensitive information stored in the database and use it to further compromise the system. active_directory_attacks: PT-CR-1342: Subrule_PowerView_Objects_Actions: Remote change of domain objects (domain users and groups, machine accounts) using the PowerView tool (PowerViewPy) is detected active_directory_attacks: PT-CR-1344: Remote_Actions_With_Domain_Objects: A PowerView script was used. Attackers use the PowerView tool for reconnaissance in Windows domains. grafana_labs: PT-CR-2327: Grafana_Service_Account_Created: A new service account was created. An attacker can use this account to escalate privileges and further compromise the system. infowatch_tm: PT-CR-2512: Infowatch_TM_Persistence_Via_User_Creation: An attacker can create a new user account and act using the account to gain persistence in the system hacking_tools: PT-CR-2134: SharpToken_Usage: SharpToken was used. This tool can find leaked tokens from all processes in the system and exploit them. If attackers accessed a low-privileged account, they can use this tool to upgrade to "NT AUTHORITY\SYSTEM" privileges. SharpToken can also be used to capture interactive user sessions.
Detection
ID | DS0017 | Data source and component | Command: Command Execution | Description | Monitor executed commands and arguments for actions that are associated with local account creation, such as |
---|
ID | DS0002 | Data source and component | User Account: User Account Creation | Description | Monitor for newly constructed user and service accounts through account audits to detect suspicious accounts that may have been created by an adversary. Collect data on account creation within a network, a Kubernetes cluster, or Windows Event ID 4720 (for when a user account is created on a Windows system and domain controller). |
---|
ID | DS0009 | Data source and component | Process: Process Creation | Description | Monitor newly executed processes associated with account creation, such as net.exe Analytic 1 - Create local admin accounts using net.exe
|
---|
Mitigation
ID | M1032 | Name | Multi-factor Authentication | Description | Use multi-factor authentication for user and privileged accounts. |
---|
ID | M1026 | Name | Privileged Account Management | Description | Limit the number of accounts permitted to create other accounts. Limit the usage of local administrator accounts to be used for day-to-day operations that may expose them to potential adversaries. |
---|