Techniques › T1136
T1136 Create Account
persistence — Windows, IaaS, Linux, macOS, Network Devices, Containers, SaaS, Office Suite, Identity Provider, ESXi · attack.mitre.org · JSON
1
MITRE detection strategy
5
analytics
3
Sigma rules tagged attack.t1136
10
KEV CVEs mapped here
<p>Adversaries may create an account to maintain access to victim systems. With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.</p><p>Accounts may be created on the local system or within a domain or cloud tenant. In cloud environments, adversaries may create accounts that only have access to specific services, which can reduce the chance of detection.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
| CVE | Vendor / product | Mapping type | State | Added |
|---|---|---|---|---|
| CVE-2025-31161 | CrushFTP CrushFTP | primary impact | Mapped | 2025-04-07 |
| CVE-2023-20198 | Cisco IOS XE Web UI | primary impact | Mapped | 2023-10-16 |
| CVE-2023-22515 | Atlassian Confluence Data Center and Server | primary impact | Mapped | 2023-10-05 |
| CVE-2023-35078 | Ivanti Endpoint Manager Mobile (EPMM) | primary impact | Mapped | 2023-07-25 |
| CVE-2023-27997 | Fortinet FortiOS and FortiProxy SSL-VPN | primary impact | Mapped | 2023-06-13 |
| CVE-2023-34362 | Progress MOVEit Transfer | secondary impact | Mapped | 2023-06-02 |
| CVE-2023-28252 | Microsoft Windows | secondary impact | Mapped | 2023-04-11 |
| CVE-2021-44077 | Zoho ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus | secondary impact | Mapped | 2021-12-01 |
| CVE-2021-34473 | Microsoft Exchange Server | secondary impact | Mapped | 2021-11-03 |
| CVE-2021-40539 | Zoho ManageEngine | secondary impact | Mapped | 2021-11-03 |
Detection strategy · ATT&CK Enterprise v19.2
- DET0583 Detection Strategy for T1136 - Create Account across platforms v1.0
AN1604 WindowsAdversary uses built-in OS tools or API calls to create local or domain accounts for persistence or lateral movement. Tools such as 'net user', PowerShell, or MMC snap-ins may be used. Detection focuses on Event ID 4720 paired with process lineage and user context.Tunable:
TimeWindowParentProcessNameUserContextAN1605 LinuxAdversary invokes 'useradd', 'adduser', or equivalent system commands or scripts to create local users. Detection focuses on command execution and audit trail of passwd/shadow file modifications.Tunable:BinaryPathExecutionTimeAN1606 macOSAdversary creates new users using 'dscl' commands, GUI tools, or by modifying user plist files. Detection includes monitoring dscl invocation and user-related plist changes.Tunable:UsernamePatternExecutionSourceAN1607 Identity ProviderAdversary creates users via IAM/IdP API or portal (e.g., Azure AD, Okta). Detection involves monitoring API calls, admin action logs, and correlation with role assignments.Tunable:AdminThresholdAutomationExemptionsAN1608 IaaSAccount creation via cloud service APIs or CLI, often associated with key generation. Monitored via CloudTrail or equivalent audit logs.Tunable:RegionServiceScope
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1136
Author: Austin Songer @austinsonger
· 2021-07-24 (modified 2022-10-09) · logsource: product=aws service=cloudtrail · 4ae68615-866f-4304-b24b-ba048dfa5ca7
Detects when an ElastiCache security group has been created.
Author: Cedric Maurugeon
· 2023-08-22 · logsource: product=linux category=process_creation · b28e4eb3-8bbc-4f0c-819f-edfe8e2f25db
Detects user account creation on ESXi system via esxcli
Author: Leo Tsaousis (@laripping)
· 2024-03-26 · logsource: product=kubernetes category=application service=audit · e31bae15-83ed-473e-bf31-faf4f8a17d36
Detects creation of new Kubernetes service account, which could indicate an attacker's attempt to persist within a cluster.