tfMITRE ATT&CK technique

Create Account T1136

Tactic: Persistence
Platforms: Windows, IaaS, Linux, macOS, Network Devices, Containers, SaaS, Office Suite, Identity Provider, ESXi
Version: 2.6
Created: 14 December 2017
Last modified: 24 October 2025
Contributors: Microsoft Threat Intelligence Center (MSTIC); Praetorian; Austin Clark, @c2defense

Sub-techniques 365 rules across the family · 8 mapped directly to T1136 · 3 of 3 carry rules

.001Local Account31 .002Domain Account11 .003Cloud Account23

Adversaries may create an account to maintain access to victim systems.[1] With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups64th pct

Threat groups64th percentile · 56% of ATT&CK techniques have fewer threat groups attributed.

Campaigns72nd pct

Campaigns72nd percentile · 54% of ATT&CK techniques have fewer campaigns recorded.

Tools & malware44th pct

Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.

Detection rules72nd pct

Detection rules72nd percentile · 69% of ATT&CK techniques have fewer detection rules written.

Offense vs defense T1136

Compare defenses against adversary use. Eight counts, ranking this technique against the entire ATT&CK Enterprise matrix. Attack sits left, defense right.

Range

Technique Campaign use over its cumulative rule count.

Campaigns · 0Sigma rules (cumulative) · 3Splunk ESCU (cumulative) · 5

Data component	Name	Channel
User Account CreationDC0014	WinEventLog:Security	EventCode=4720
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1

Data component

Name

Channel

User Account CreationDC0014

WinEventLog:Security

EventCode=4720

Process CreationDC0032

WinEventLog:Sysmon

EventCode=1

Field	What you tune
TimeWindow	Correlation between Event ID 4720 and creating process may vary by environment and automation delays
ParentProcessName	Tools like net.exe or powershell.exe can be normal or malicious depending on user context
UserContext	System vs. administrator vs. low-privilege user context changes alert criticality

Field

What you tune

TimeWindow

Correlation between Event ID 4720 and creating process may vary by environment and automation delays

ParentProcessName

Tools like net.exe or powershell.exe can be normal or malicious depending on user context

UserContext

System vs. administrator vs. low-privilege user context changes alert criticality

Data component	Name	Channel
User Account CreationDC0014	auditd:SYSCALL	useradd or adduser executed
File ModificationDC0061	auditd:SYSCALL	chmod/chown to /etc/passwd or /etc/shadow

Field	What you tune
BinaryPath	Custom scripts or renamed binaries may evade simple path-based detection
ExecutionTime	Account creation outside maintenance windows may indicate compromise

Data component	Name	Channel
File ModificationDC0061	macos:unifiedlog	modification to /var/db/dslocal/nodes/Default/users/
Command ExecutionDC0064	macos:unifiedlog	dscl . -create

Field	What you tune
UsernamePattern	Attackers may use service-like names to hide malicious accounts
ExecutionSource	Accounts created via Terminal vs GUI vs remote session can affect confidence

Data component	Name	Channel
User Account CreationDC0014	azure:audit	Add user

Field	What you tune
AdminThreshold	Trigger alert only when account is assigned privileged roles
AutomationExemptions	Exclude accounts from known automation processes or provisioning pipelines

Data component	Name	Channel
User Account ModificationDC0010	AWS:CloudTrail	AttachUserPolicy
User Account CreationDC0014	AWS:CloudTrail	CreateUser

Field	What you tune
Region	Alert on account creation outside expected geographies
ServiceScope	Filter on creation of users scoped to sensitive services

Offense vs defense T1136

Compare defenses against adversary use. Eight counts, ranking this technique against the entire ATT&CK Enterprise matrix. Attack sits left, defense right.

Range

Technique Campaign use over its cumulative rule count.

Campaigns · 0Sigma rules (cumulative) · 3Splunk ESCU (cumulative) · 5

Data component	Name	Channel
User Account CreationDC0014	WinEventLog:Security	EventCode=4720
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1

Data component

Name

Channel

User Account CreationDC0014

WinEventLog:Security

EventCode=4720

Process CreationDC0032

WinEventLog:Sysmon

EventCode=1

Field	What you tune
TimeWindow	Correlation between Event ID 4720 and creating process may vary by environment and automation delays
ParentProcessName	Tools like net.exe or powershell.exe can be normal or malicious depending on user context
UserContext	System vs. administrator vs. low-privilege user context changes alert criticality

Field

What you tune

TimeWindow

Correlation between Event ID 4720 and creating process may vary by environment and automation delays

ParentProcessName

Tools like net.exe or powershell.exe can be normal or malicious depending on user context

UserContext

System vs. administrator vs. low-privilege user context changes alert criticality

Data component	Name	Channel
User Account CreationDC0014	auditd:SYSCALL	useradd or adduser executed
File ModificationDC0061	auditd:SYSCALL	chmod/chown to /etc/passwd or /etc/shadow

Field	What you tune
BinaryPath	Custom scripts or renamed binaries may evade simple path-based detection
ExecutionTime	Account creation outside maintenance windows may indicate compromise

Data component	Name	Channel
File ModificationDC0061	macos:unifiedlog	modification to /var/db/dslocal/nodes/Default/users/
Command ExecutionDC0064	macos:unifiedlog	dscl . -create

Field	What you tune
UsernamePattern	Attackers may use service-like names to hide malicious accounts
ExecutionSource	Accounts created via Terminal vs GUI vs remote session can affect confidence

Data component	Name	Channel
User Account CreationDC0014	azure:audit	Add user

Field	What you tune
AdminThreshold	Trigger alert only when account is assigned privileged roles
AutomationExemptions	Exclude accounts from known automation processes or provisioning pipelines

Data component	Name	Channel
User Account ModificationDC0010	AWS:CloudTrail	AttachUserPolicy
User Account CreationDC0014	AWS:CloudTrail	CreateUser

Field	What you tune
Region	Alert on account creation outside expected geographies
ServiceScope	Filter on creation of users scoped to sensitive services

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID
	Detects when an ElastiCache security group has been created.	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Persistence Create Account Cloud Account	-	low	Austin Songer @austinsonger	2021-07-24	2022-10-09	4ae68615-866f-4304-b24b-ba048dfa5ca7
Splunk	This analytic detects the creation of privileged user accounts on Cisco IOS devices, which could indicate an attacker establishing backdoor access. (...)	Anomaly	stable	configuration_change	-	Cisco IOS · Cisco	Persistence Create Account Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	CVE-2018-0171	medium	Bhavin Patel, Michael Haag, Splunk	2025-08-21	2026-05-13	63e3aff9-45d7-4d41-bcdb-9da561fb4533
Splunk	This analytic correlates risk events between privileged account creation on Cisco IOS devices and HTTP requests to privileged execution paths such as `/level/15/exec/-/*`. (...)	Correlation	stable	-	-	Cisco	Persistence Create Account Lateral Movement Remote Services SSH Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Nasreddine Bencherchali, Splunk	2026-01-12	2026-05-13	2c9d4f5a-8b6e-4c7f-9d8e-1a2b3c4d5e6f
Splunk	This analytic detects a correlation between privileged account creation on Cisco IOS devices and sub (...)	Correlation	stable	-	-	Cisco	Persistence Create Account Lateral Movement Remote Services SSH Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Nasreddine Bencherchali, Splunk	2026-01-12	2026-05-13	7f8e2b4c-9a3d-4e1f-8c5b-6d7e8f9a0b1c
	Detects user account creation on ESXi system via esxcli	Generic	test	process_creation	linux	Sysmon	Execution Command and Scripting Interpreter Hypervisor CLI Persistence Create Account	-	medium	Cedric Maurugeon	2023-08-22	—	b28e4eb3-8bbc-4f0c-819f-edfe8e2f25db
Splunk	The following analytic detects the creation of a new local user account on a MacOS system. (...)	Anomaly	stable	process_creation	-	Osquery	Persistence Create Account	-	medium	Raven Tait, Splunk	2026-04-14	2026-09-01	491004ae-694f-453e-b1e0-fc1e65daeea1
	Detects creation of new Kubernetes service account, which could indicate an attacker's attempt to persist within a cluster.	Generic	test	-	-	Kubernetes Audit · Kubernetes	Persistence Create Account	-	low	Leo Tsaousis (@laripping)	2024-03-26	—	e31bae15-83ed-473e-bf31-faf4f8a17d36
Splunk	This analytic detects the usage of the Azure CLI to interact with user accounts such as creating or deleting a user. (...)	Anomaly	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Persistence, Privilege Escalation Account Manipulation Persistence Create Account Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	medium	Raven Tait, Splunk	2026-05-05	2026-10-09	f6332409-abeb-42f8-b6a7-76201bdc7a0a

Title

Description

Create Account T1136

Create Account T1136

Create Account MITRE reference T1136

Offense vs defense T1136

Create Account detection strategy DET0583

Detection Strategy for T1136 - Create Account across platforms

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Create Account MITRE reference T1136

Offense vs defense T1136

Create Account detection strategy DET0583

Detection Strategy for T1136 - Create Account across platforms

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Create Account detections T1136

Create Account detections T1136