Create Account (T1136)

Tactic: Persistence · Platforms: Windows, IaaS, Linux, macOS, Network Devices, Containers, SaaS, Office Suite, Identity Provider, ESXi

The interactive view maps 1 detection strategy, 4 mitigations, 3 threat groups, 1 software entry, 1 campaign to this technique, alongside D3FEND countermeasures and data-component coverage.

Overview

Adversaries may create an account to maintain access to victim systems. With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.

Accounts may be created on the local system or within a domain or cloud tenant. In cloud environments, adversaries may create accounts that only have access to specific services, which can reduce the chance of detection.

Sub-techniques

• Local Account (T1136.001)
• Domain Account (T1136.002)
• Cloud Account (T1136.003)

Explore

• Open T1136 in the interactive ATT&CK matrix
• ATT&CK Intelligence View guide
• Official MITRE ATT&CK entry for T1136
• Sigma detection rules for MITRE ATT&CK
• Built by Shahrukh Khan