Medusa GroupG1051 ↗
Has created a domain account within the victim environment.1
- Tactic
- Persistence
- Platforms
- Linux, macOS, Windows
- Version
- 1.1
- Created
- 28 January 2020
- Last modified
- 24 October 2025
Adversaries may create a domain account to maintain access to victim systems. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover user, administrator, and service accounts. With a sufficient level of access, the net user /add /domain command can be used to create a domain account.[1]
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
5
Threat groups73rd pct
Threat groups73rd percentile · 73% of ATT&CK techniques have this many threat groups attributed or fewer.2
CampaignsTop 17%
Campaigns83rd percentile · 83% of ATT&CK techniques have this many campaigns recorded or fewer.4
Tools & malware62nd pct
Tools & malware62nd percentile · 62% of ATT&CK techniques have this many tools implementing them or fewer.11
Detection rulesTop 23%
Detection rules77th percentile · 77% of ATT&CK techniques have this many detection rules written or fewer.Domain Account MITRE reference T1136.002
73rd pctamong all ATT&CK techniques for number of groups
5 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
BlackByteG1043 ↗
Created privileged domain accounts during intrusions.1
HAFNIUMG0125 ↗
Wizard SpiderG0102 ↗
Has created and used new accounts within a victim's Active Directory environment to maintain persistence.1
GALLIUMG0093 ↗
Created high-privileged domain user accounts to maintain access to victim networks.12
All 5 groups for this technique
2 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
2016 Ukraine Electric Power AttackC0025 ↗
During the 2016 Ukraine Electric Power Attack, Sandworm Team created two new accounts, “admin” and “система” (System). The accounts were then assigned to a domain matching local operation and were delegated new privileges.1
2015 Ukraine Electric Power AttackC0028 ↗
During the 2015 Ukraine Electric Power Attack, Sandworm Team created privileged domain accounts to be used for further exploitation and lateral movement. 1
All 2 campaigns for this technique
4 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
EmpireS0363 ↗
Has a module for creating a new domain user if permissions allow.1
PupyS0192 ↗
Can user PowerView to execute “net user” commands and create domain accounts.1
NetS0039 ↗
The net user username \password \domain commands in Net can be used to create a domain account.1
PsExecS0029 ↗
Has the ability to remotely create accounts on target systems.1
All 4 software entries for this technique
Offense vs defense T1136.002
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 2Sigma rules (cumulative) · 6Splunk ESCU (cumulative) · 5
first rule: 2019 Q4 · 2 of 2 campaigns plottedDomain Account detection strategy DET0003
MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
T1136.002 Detection Strategy - Domain Account Creation Across Platforms
3 platforms
AN0006 · Windows
Adversary uses built-in tools such as 'net user /add /domain' or PowerShell to create a domain user account. The behavior chain includes: (1) suspicious process execution on a domain controller followed by (2) user account creation event (Event ID 4720) on the same host.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| User Account CreationDC0014 | WinEventLog:Security | EventCode=4720 |
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TimeWindow | Detection triggers when Event ID 4720 follows a suspicious process within 2 minutes. |
| ParentProcessName | Allow filtering of known admin tools vs adversarial misuse (e.g., net.exe, powershell.exe). |
| UserContext | Filter accounts with domain admin privileges creating new users vs standard helpdesk roles. |
| HostRole | Restrict to only domain controller hosts to reduce noise from workstations. |
AN0007 · Linux
Adversary with access to domain management tools (e.g., realmd, samba-tool, ldapmodify) creates a new domain user via command-line utilities. Behavior chain: LDAP command or script triggers → user entry added in AD via Kerberos/LDAP traffic.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| User Account AuthenticationDC0002 | NSM:Flow | TGS-REQ and AS-REQ seen for new user shortly after domain-modifying process |
| Command ExecutionDC0064 | auditd:SYSCALL | execution of realmd, samba-tool, or ldapmodify with user-related arguments |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| DomainToolUsed | realmd, samba-tool, ldapmodify or custom script |
| TrafficWindow | Expected Kerberos traffic from new domain account within X minutes of command |
| SessionType | Script execution from interactive shell vs scheduled task |
AN0008 · macOS
macOS clients joined to AD via LDAP may script account provisioning via dsconfigad, dscl, or LDAP scripts. Detection occurs when such tools run on a domain-joined system, followed by authentication attempts by a previously unseen account.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Command ExecutionDC0064 | macos:unifiedlog | dsconfigad or dscl with create or append options for AD-bound users |
| Logon Session CreationDC0067 | macos:unifiedlog | UserLoggedIn |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| EnrollmentStatus | Only flag on AD-bound systems with valid LDAP context |
| AccountType | Distinguish between user accounts and computer accounts |
Use multi-factor authentication for user and privileged accounts.
Network SegmentationM1030
Configure access controls and firewalls to limit access to domain controllers and systems used to create and manage accounts.
Protect domain controllers by ensuring proper security configuration for critical servers.
Limit the number of accounts with permissions to create other accounts. Do not allow domain administrator accounts to be used for day-to-day operations that may expose them to potential adversaries on unprivileged systems.
Tests5Executorscmd 2 · sh 2 · PowerShell 1Need elevation0 of 5Have prerequisites2Have cleanup5Platformswindows, linux
Tests from Atomic Red Team (MIT licence) · technique definition