Technique on mitre.org

T1136.002: Domain Account

Adversaries may create a domain account to maintain access to victim systems. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover user, administrator, and service accounts. With a sufficient level of access, the net user /add /domain command can be used to create a domain account.

Such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.

Positive Technologies products that cover the technique

MaxPatrol SIEM knowledge base

capabilities_account_manipulation: PT-CR-2876: CAP_User_Creation: Creation of a new user in application software. This could be an attacker's attempt to maintain access to the target system. active_directory_attacks: PT-CR-1344: Remote_Actions_With_Domain_Objects: A PowerView script was used. Attackers use the PowerView tool for reconnaissance in Windows domains. active_directory_attacks: PT-CR-1342: Subrule_PowerView_Objects_Actions: Remote change of domain objects (domain users and groups, machine accounts) using the PowerView tool (PowerViewPy) is detected mitre_attck_persistence: PT-CR-2143: Remote_Creation_Of_Computer_Account_By_Local_User: A user initiated the creation of a computer account. Attackers create computer accounts using accounts of users that are not administrators or do not have delegated permissions to add computer accounts. The created account can be used for lateral movement or privilege escalation. mitre_attck_persistence: PT-CR-259: Account_Created_On_Local_System: An attempt was detected to create a local or domain account and add it to the local administrators group mitre_attck_persistence: PT-CR-663: Created_User_On_Domain_Controller: A user created a user mitre_attck_persistence: PT-CR-264: Add_New_User_In_Commandline: An attempt to create an account using the command line or PowerShell is detected

Detection

ID	DS0017	Data source and component	Command: Command Execution	Description	Monitor executed commands and arguments for actions that are associated with local account creation, such as net user /add /domain.

ID	DS0002	Data source and component	User Account: User Account Creation	Description	Monitor for newly constructed user accounts through account audits to detect suspicious accounts that may have been created by an adversary. Collect data on account creation within a network or Windows Event ID 4720 (for when a user account is created on a Windows system and domain controller).

ID	DS0009	Data source and component	Process: Process Creation	Description	Monitor newly executed processes associated with account creation, such as net.exe

ID	Data source and component	Description
DS0017	Command: Command Execution	Monitor executed commands and arguments for actions that are associated with local account creation, such as net user /add /domain.
DS0002	User Account: User Account Creation	Monitor for newly constructed user accounts through account audits to detect suspicious accounts that may have been created by an adversary. Collect data on account creation within a network or Windows Event ID 4720 (for when a user account is created on a Windows system and domain controller).
DS0009	Process: Process Creation	Monitor newly executed processes associated with account creation, such as net.exe

Mitigation

ID	M1026	Name	Privileged Account Management	Description	Limit the number of accounts with permissions to create other accounts. Do not allow domain administrator accounts to be used for day-to-day operations that may expose them to potential adversaries on unprivileged systems.

ID	M1028	Name	Operating System Configuration	Description	Protect domain controllers by ensuring proper security configuration for critical servers.

ID	M1030	Name	Network Segmentation	Description	Configure access controls and firewalls to limit access to domain controllers and systems used to create and manage accounts.

ID	M1032	Name	Multi-factor Authentication	Description	Use multi-factor authentication for user and privileged accounts.

ID	Name	Description
M1026	Privileged Account Management	Limit the number of accounts with permissions to create other accounts. Do not allow domain administrator accounts to be used for day-to-day operations that may expose them to potential adversaries on unprivileged systems.
M1028	Operating System Configuration	Protect domain controllers by ensuring proper security configuration for critical servers.
M1030	Network Segmentation	Configure access controls and firewalls to limit access to domain controllers and systems used to create and manage accounts.
M1032	Multi-factor Authentication	Use multi-factor authentication for user and privileged accounts.