Salt TyphoonG1045 ↗
Has created Linux-level users on compromised network devices through modification of /etc/shadow and /etc/passwd.1
tfMITRE ATT&CK technique
Create Account T1136
- Tactic
- Persistence
- Platforms
- Windows, IaaS, Linux, macOS, Network Devices, Containers, SaaS, Office Suite, Identity Provider, ESXi
- Version
- 2.6
- Created
- 14 December 2017
- Last modified
- 24 October 2025
- Contributors
- Microsoft Threat Intelligence Center (MSTIC); Praetorian; Austin Clark, @c2defense
Sub-techniques 365 rules across the family · 8 mapped directly to T1136 · 3 of 3 carry rules
Adversaries may create an account to maintain access to victim systems.[1] With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
3
Threat groups64th pct
Threat groups64th percentile · 64% of ATT&CK techniques have this many threat groups attributed or fewer.1
Campaigns72nd pct
Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.1
Tools & malware44th pct
Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.8
Detection rules71st pct
Detection rules71st percentile · 71% of ATT&CK techniques have this many detection rules written or fewer.Create Account MITRE reference T1136
64th pctamong all ATT&CK techniques for number of groups
3 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Scattered SpiderG1015 ↗
Creates new user identities within the compromised organization.1
Indrik SpiderG0119 ↗
Used wmic.exe to add a new user to the system.1
All 3 groups for this technique
1 campaign has been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
2016 Ukraine Electric Power AttackC0025 ↗
During the 2016 Ukraine Electric Power Attack, Sandworm Team added a login to a SQL Server with sp_addlinkedsrvlogin.1
All 1 campaigns for this technique
Offense vs defense T1136
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 0Sigma rules (cumulative) · 3Splunk ESCU (cumulative) · 5
first rule: 2021 Q3 · 0 of 1 campaigns plotted (2016 Ukraine Electric Power Attack (dated 2016) falls before the 2018 window)Create Account detection strategy DET0583
MITRE names one behaviour worth catching for this technique and breaks it into 5 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection Strategy for T1136 - Create Account across platforms
5 platforms
AN1604 · Windows
Adversary uses built-in OS tools or API calls to create local or domain accounts for persistence or lateral movement. Tools such as 'net user', PowerShell, or MMC snap-ins may be used. Detection focuses on Event ID 4720 paired with process lineage and user context.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| User Account CreationDC0014 | WinEventLog:Security | EventCode=4720 |
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TimeWindow | Correlation between Event ID 4720 and creating process may vary by environment and automation delays |
| ParentProcessName | Tools like net.exe or powershell.exe can be normal or malicious depending on user context |
| UserContext | System vs. administrator vs. low-privilege user context changes alert criticality |
AN1605 · Linux
Adversary invokes 'useradd', 'adduser', or equivalent system commands or scripts to create local users. Detection focuses on command execution and audit trail of passwd/shadow file modifications.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| User Account CreationDC0014 | auditd:SYSCALL | useradd or adduser executed |
| File ModificationDC0061 | auditd:SYSCALL | chmod/chown to /etc/passwd or /etc/shadow |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| BinaryPath | Custom scripts or renamed binaries may evade simple path-based detection |
| ExecutionTime | Account creation outside maintenance windows may indicate compromise |
AN1606 · macOS
Adversary creates new users using 'dscl' commands, GUI tools, or by modifying user plist files. Detection includes monitoring dscl invocation and user-related plist changes.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| File ModificationDC0061 | macos:unifiedlog | modification to /var/db/dslocal/nodes/Default/users/ |
| Command ExecutionDC0064 | macos:unifiedlog | dscl . -create |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| UsernamePattern | Attackers may use service-like names to hide malicious accounts |
| ExecutionSource | Accounts created via Terminal vs GUI vs remote session can affect confidence |
AN1607 · Identity Provider
Adversary creates users via IAM/IdP API or portal (e.g., Azure AD, Okta). Detection involves monitoring API calls, admin action logs, and correlation with role assignments.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| User Account CreationDC0014 | azure:audit | Add user |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| AdminThreshold | Trigger alert only when account is assigned privileged roles |
| AutomationExemptions | Exclude accounts from known automation processes or provisioning pipelines |
AN1608 · IaaS
Account creation via cloud service APIs or CLI, often associated with key generation. Monitored via CloudTrail or equivalent audit logs.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| User Account ModificationDC0010 | AWS:CloudTrail | AttachUserPolicy |
| User Account CreationDC0014 | AWS:CloudTrail | CreateUser |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| Region | Alert on account creation outside expected geographies |
| ServiceScope | Filter on creation of users scoped to sensitive services |
Use multi-factor authentication for user and privileged accounts.
Network SegmentationM1030
Configure access controls and firewalls to limit access to domain controllers and systems used to create and manage accounts.
Protect domain controllers by ensuring proper security configuration for critical servers.
Limit the number of accounts with permissions to create other accounts. Do not allow domain administrator accounts to be used for day-to-day operations that may expose them to potential adversaries on unprivileged systems.