{"id":"T1136.002","name":"Domain Account","url":"https://attack.mitre.org/techniques/T1136/002","tactics":["persistence"],"platforms":["Linux","macOS","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0003","stix_id":"x-mitre-detection-strategy--aae40136-73f7-45e8-a37f-104ae7155bbe","name":"T1136.002 Detection Strategy - Domain Account Creation Across Platforms","url":"https://attack.mitre.org/detectionstrategies/DET0003","analytics":[{"id":"AN0006","stix_id":"x-mitre-analytic--86103b48-cd6d-447d-aef4-807e10355506","name":"Analytic 0006","description":"Adversary uses built-in tools such as 'net user /add /domain' or PowerShell to create a domain user account. The behavior chain includes: (1) suspicious process execution on a domain controller followed by (2) user account creation event (Event ID 4720) on the same host.","url":"https://attack.mitre.org/detectionstrategies/DET0003#AN0006","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Security","channel":"EventCode=4720","data_component":"DC0014","data_component_name":"User Account Creation","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"TimeWindow","description":"Detection triggers when Event ID 4720 follows a suspicious process within 2 minutes."},{"field":"ParentProcessName","description":"Allow filtering of known admin tools vs adversarial misuse (e.g., net.exe, powershell.exe)."},{"field":"UserContext","description":"Filter accounts with domain admin privileges creating new users vs standard helpdesk roles."},{"field":"HostRole","description":"Restrict to only domain controller hosts to reduce noise from workstations."}],"live":true,"detection_strategies":["DET0003"],"techniques":["T1136.002"]},{"id":"AN0007","stix_id":"x-mitre-analytic--e86081ab-aad1-48a1-abd8-5a5c8c7c936a","name":"Analytic 0007","description":"Adversary with access to domain management tools (e.g., `realmd`, `samba-tool`, `ldapmodify`) creates a new domain user via command-line utilities. Behavior chain: LDAP command or script triggers → user entry added in AD via Kerberos/LDAP traffic.","url":"https://attack.mitre.org/detectionstrategies/DET0003#AN0007","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"execution of realmd, samba-tool, or ldapmodify with user-related arguments","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"auditd-syscall"},{"name":"NSM:Flow","channel":"TGS-REQ and AS-REQ seen for new user shortly after domain-modifying process","data_component":"DC0002","data_component_name":"User Account Authentication","log_source_slug":"nsm-flow"}],"mutable_elements":[{"field":"DomainToolUsed","description":"realmd, samba-tool, ldapmodify or custom script"},{"field":"TrafficWindow","description":"Expected Kerberos traffic from new domain account within X minutes of command"},{"field":"SessionType","description":"Script execution from interactive shell vs scheduled task"}],"live":true,"detection_strategies":["DET0003"],"techniques":["T1136.002"]},{"id":"AN0008","stix_id":"x-mitre-analytic--03513eb2-6dbd-4160-94dd-25d2bce349be","name":"Analytic 0008","description":"macOS clients joined to AD via LDAP may script account provisioning via `dsconfigad`, `dscl`, or LDAP scripts. Detection occurs when such tools run on a domain-joined system, followed by authentication attempts by a previously unseen account.","url":"https://attack.mitre.org/detectionstrategies/DET0003#AN0008","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"dsconfigad or dscl with create or append options for AD-bound users","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"macos-unifiedlog"},{"name":"macos:unifiedlog","channel":"UserLoggedIn","data_component":"DC0067","data_component_name":"Logon Session Creation","log_source_slug":"macos-unifiedlog"}],"mutable_elements":[{"field":"EnrollmentStatus","description":"Only flag on AD-bound systems with valid LDAP context"},{"field":"AccountType","description":"Distinguish between user accounts and computer accounts"}],"live":true,"detection_strategies":["DET0003"],"techniques":["T1136.002"]}],"live":true,"version":"1.0","techniques":["T1136.002"]}],"sigma_rules":[{"id":"1bbf25b9-8038-4154-a50b-118f2a32be27","title":"Suspicious Windows ANONYMOUS LOGON Local Account Created","author":"James Pemberton / @4A616D6573","status":"test","level":"high","date":"2019-10-31","modified":"2022-10-09","description":"Detects the creation of suspicious accounts similar to ANONYMOUS LOGON, such as using additional spaces. Created as an covering detection for exclusion of Logon Type 3 from ANONYMOUS LOGON accounts.","references":["https://twitter.com/SBousseaden/status/1189469425482829824"],"logsource":{"product":"windows","service":"security"},"tags":["attack.persistence","attack.t1136.001","attack.t1136.002"],"path":"rules/windows/builtin/security/win_security_susp_local_anon_logon_created.yml","techniques":["T1136.001","T1136.002"],"cves":[]},{"id":"304afd73-55a5-4bb9-8c21-0b1fc84ea9e4","title":"PSEXEC Remote Execution File Artefact","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2023-01-21","modified":"2023-02-23","description":"Detects creation of the PSEXEC key file. Which is created anytime a PsExec command is executed. It gets written to the file system and will be recorded in the USN Journal on the target system","references":["https://aboutdfir.com/the-key-to-identify-psexec/","https://twitter.com/davisrichardg/status/1616518800584704028"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.lateral-movement","attack.privilege-escalation","attack.execution","attack.persistence","attack.t1136.002","attack.t1543.003","attack.t1570","attack.s0029"],"path":"rules/windows/file/file_event/file_event_win_sysinternals_psexec_service_key.yml","techniques":["T1136.002","T1543.003","T1570"],"cves":[]},{"id":"7c9fed65-039a-4055-8c23-fa763d94aff6","title":"New User Account Creation Attempt Via ADSI in CommandLine","author":"William Gokah (idea), Raylee Hawkins, Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"medium","date":"2026-08-13","modified":null,"description":"Detects PowerShell command line arguments containing ADSI (Active Directory Service Interfaces) patterns\ntrying to create a new user account via the WinNT or LDAP provider. This is an uncommon method to create\nuser accounts and may indicate an attempt to evade detection by avoiding more commonly monitored commands\nsuch as \"net user\", \"New-LocalUser\" or \"New-ADUser\".\n","references":["https://learn.microsoft.com/en-us/windows/win32/adsi/user-creation-with-the-adsi-ldap-provider","https://learn.microsoft.com/en-us/windows/win32/adsi/adsi-winnt-provider"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.persistence","attack.t1136.001","attack.t1136.002"],"path":"rules/windows/process_creation/proc_creation_win_powershell_adsi_create_user.yml","techniques":["T1136.001","T1136.002"],"cves":[]},{"id":"b29a93fb-087c-4b5b-a84d-ee3309e69d08","title":"Manipulation of User Computer or Group Security Principals Across AD","author":"frack113","status":"test","level":"medium","date":"2021-12-28","modified":null,"description":"Adversaries may create a domain account to maintain access to victim systems.\nDomain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain..\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1136.002/T1136.002.md#atomic-test-3---create-a-new-domain-account-using-powershell","https://learn.microsoft.com/en-us/dotnet/api/system.directoryservices.accountmanagement?view=net-8.0"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.persistence","attack.t1136.002"],"path":"rules/windows/powershell/powershell_script/posh_ps_directoryservices_accountmanagement.yml","techniques":["T1136.002"],"cves":[]},{"id":"e50d5d26-0cf6-4045-b82b-13c0a4e316be","title":"New User Account Creation Attempt Via ADSI","author":"William Gokah (idea), Raylee Hawkins, Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"medium","date":"2026-08-13","modified":null,"description":"Detects an attempt to create a new user account via ADSI (Active Directory Service Interfaces)\nusing either the WinNT or LDAP provider. This is an uncommon method to create user accounts\nand may indicate an attempt to evade detection by avoiding more commonly monitored commands\nsuch as \"net user\", \"New-LocalUser\" or \"New-ADUser\".\n","references":["https://learn.microsoft.com/en-us/windows/win32/adsi/user-creation-with-the-adsi-ldap-provider","https://learn.microsoft.com/en-us/windows/win32/adsi/adsi-winnt-provider"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.persistence","attack.t1136.001","attack.t1136.002"],"path":"rules/windows/powershell/powershell_script/posh_ps_adsi_create_user.yml","techniques":["T1136.001","T1136.002"],"cves":[]},{"id":"fa0bac5f-d170-4a91-9780-1ad71dc1f49e","title":"ADCS - Certighost Ghost Machine Account Creation","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2026-07-30","modified":null,"description":"Detects the creation of a machine account whose name starts with 'GHOST', which is the\nnaming convention used by the CVE-2026-54121 (Certighost) exploit tooling.\n\nThe public proof-of-concept for Certighost creates a temporary machine account with a\nname of the form GHOST<random>$ before enrolling for a DC certificate via the cdc chase\npath. The attacker-controlled machine account is used as the requester identity in the\ncertificate request; the cdc attribute then redirects the CA to a rogue host that returns\na forged Domain Controller identity. The resulting certificate carries the DC's SID and\nDNS name, enabling full PKINIT authentication as the targeted DC followed by DCSync.\n\nA machine account creation event (4741) where TargetUserName starts with 'GHOST' and\nends with '$' is a high-fidelity indicator of this attack tool's execution. Legitimate\nenvironments very rarely provision machine accounts with this prefix.\n","references":["https://github.com/aniqfakhrul/CVE-2026-54121","https://gist.github.com/H0j3n/a5ef2609b5f2944ac2390a191a534c26"],"logsource":{"product":"windows","service":"security"},"tags":["attack.privilege-escalation","attack.credential-access","attack.persistence","attack.t1136.002","attack.t1649","cve.2026-54121","detection.emerging-threats"],"path":"rules-emerging-threats/2026/Exploits/CVE-2026-54121/win_security_adcs_certighost_ghost_machine_account_creation.yml","techniques":["T1136.002","T1649"],"cves":["CVE-2026-54121"]}],"kev_cves":[],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}