Create Account: Domain Account (T1136.002)

Tactic: Persistence · Platforms: Linux, macOS, Windows

The interactive view maps 1 detection strategy, 4 mitigations, 5 threat groups, 4 software entries, 2 campaigns to this technique, alongside D3FEND countermeasures and data-component coverage.

Sub-technique of Create Account (T1136).

Overview

Adversaries may create a domain account to maintain access to victim systems. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover user, administrator, and service accounts. With a sufficient level of access, the net user /add /domain command can be used to create a domain account.

Such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.

Explore

• Open T1136.002 in the interactive ATT&CK matrix
• ATT&CK Intelligence View guide
• Official MITRE ATT&CK entry for T1136.002
• Sigma detection rules for MITRE ATT&CK
• Built by Shahrukh Khan