T1136 Create Account — ATT&CK Technique

Adversaries may create an account to maintain access to victim systems. With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system. Accounts may be created on the local system or within a domain or cloud tenant. In cloud environments, adversaries may create accounts that only have access to specific services, which can reduce the chance of detection.

Detection coverage (8)

• New Kubernetes Service Account Created low
• AWS ElastiCache Security Group Created low
• ESXi Account Creation Via ESXCLI medium
• MacOS Account Created
• Windows Entra User Management Via Azure CLI
• Cisco Privileged Account Creation with Suspicious SSH Activity
• Cisco IOS Suspicious Privileged Account Creation
• Cisco Privileged Account Creation with HTTP Command Execution

Malware using this technique

• LockBit 2.0

Threat actors using this technique

• Evil Corp
• Scattered Spider
• Salt Typhoon

Read the full analysis on IntelFusions