{"id":"T1136","name":"Create Account","url":"https://attack.mitre.org/techniques/T1136","tactics":["persistence"],"platforms":["Windows","IaaS","Linux","macOS","Network Devices","Containers","SaaS","Office Suite","Identity Provider","ESXi"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0583","stix_id":"x-mitre-detection-strategy--552bacaa-9df5-4c95-83de-a7d1948003b5","name":"Detection Strategy for T1136 - Create Account across platforms","url":"https://attack.mitre.org/detectionstrategies/DET0583","analytics":[{"id":"AN1604","stix_id":"x-mitre-analytic--33d574c3-8e9b-462d-b3d1-09e64c2fa8c7","name":"Analytic 1604","description":"Adversary uses built-in OS tools or API calls to create local or domain accounts for persistence or lateral movement. Tools such as 'net user', PowerShell, or MMC snap-ins may be used. Detection focuses on Event ID 4720 paired with process lineage and user context.","url":"https://attack.mitre.org/detectionstrategies/DET0583#AN1604","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Security","channel":"EventCode=4720","data_component":"DC0014","data_component_name":"User Account Creation","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"TimeWindow","description":"Correlation between Event ID 4720 and creating process may vary by environment and automation delays"},{"field":"ParentProcessName","description":"Tools like net.exe or powershell.exe can be normal or malicious depending on user context"},{"field":"UserContext","description":"System vs. administrator vs. low-privilege user context changes alert criticality"}],"live":true,"detection_strategies":["DET0583"],"techniques":["T1136"]},{"id":"AN1605","stix_id":"x-mitre-analytic--9d70d90c-f318-4318-a18d-e4775ffa229e","name":"Analytic 1605","description":"Adversary invokes 'useradd', 'adduser', or equivalent system commands or scripts to create local users. Detection focuses on command execution and audit trail of passwd/shadow file modifications.","url":"https://attack.mitre.org/detectionstrategies/DET0583#AN1605","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"useradd or adduser executed","data_component":"DC0014","data_component_name":"User Account Creation","log_source_slug":"auditd-syscall"},{"name":"auditd:SYSCALL","channel":"chmod/chown to /etc/passwd or /etc/shadow","data_component":"DC0061","data_component_name":"File Modification","log_source_slug":"auditd-syscall"}],"mutable_elements":[{"field":"BinaryPath","description":"Custom scripts or renamed binaries may evade simple path-based detection"},{"field":"ExecutionTime","description":"Account creation outside maintenance windows may indicate compromise"}],"live":true,"detection_strategies":["DET0583"],"techniques":["T1136"]},{"id":"AN1606","stix_id":"x-mitre-analytic--ddaf8ed8-f6bd-4eac-911c-d9fd243e87e9","name":"Analytic 1606","description":"Adversary creates new users using 'dscl' commands, GUI tools, or by modifying user plist files. Detection includes monitoring dscl invocation and user-related plist changes.","url":"https://attack.mitre.org/detectionstrategies/DET0583#AN1606","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"dscl . -create","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"macos-unifiedlog"},{"name":"macos:unifiedlog","channel":"modification to /var/db/dslocal/nodes/Default/users/","data_component":"DC0061","data_component_name":"File Modification","log_source_slug":"macos-unifiedlog"}],"mutable_elements":[{"field":"UsernamePattern","description":"Attackers may use service-like names to hide malicious accounts"},{"field":"ExecutionSource","description":"Accounts created via Terminal vs GUI vs remote session can affect confidence"}],"live":true,"detection_strategies":["DET0583"],"techniques":["T1136"]},{"id":"AN1607","stix_id":"x-mitre-analytic--7947aae5-fd76-403c-8c73-1300dff7d30f","name":"Analytic 1607","description":"Adversary creates users via IAM/IdP API or portal (e.g., Azure AD, Okta). Detection involves monitoring API calls, admin action logs, and correlation with role assignments.","url":"https://attack.mitre.org/detectionstrategies/DET0583#AN1607","platforms":["Identity Provider"],"log_source_references":[{"name":"azure:audit","channel":"Add user","data_component":"DC0014","data_component_name":"User Account Creation","log_source_slug":"azure-audit"}],"mutable_elements":[{"field":"AdminThreshold","description":"Trigger alert only when account is assigned privileged roles"},{"field":"AutomationExemptions","description":"Exclude accounts from known automation processes or provisioning pipelines"}],"live":true,"detection_strategies":["DET0583"],"techniques":["T1136"]},{"id":"AN1608","stix_id":"x-mitre-analytic--d715d148-4d2d-407c-bd83-c471a4163d4e","name":"Analytic 1608","description":"Account creation via cloud service APIs or CLI, often associated with key generation. Monitored via CloudTrail or equivalent audit logs.","url":"https://attack.mitre.org/detectionstrategies/DET0583#AN1608","platforms":["IaaS"],"log_source_references":[{"name":"AWS:CloudTrail","channel":"CreateUser","data_component":"DC0014","data_component_name":"User Account Creation","log_source_slug":"aws-cloudtrail"},{"name":"AWS:CloudTrail","channel":"AttachUserPolicy","data_component":"DC0010","data_component_name":"User Account Modification","log_source_slug":"aws-cloudtrail"}],"mutable_elements":[{"field":"Region","description":"Alert on account creation outside expected geographies"},{"field":"ServiceScope","description":"Filter on creation of users scoped to sensitive services"}],"live":true,"detection_strategies":["DET0583"],"techniques":["T1136"]}],"live":true,"version":"1.0","techniques":["T1136"]}],"sigma_rules":[{"id":"4ae68615-866f-4304-b24b-ba048dfa5ca7","title":"AWS ElastiCache Security Group Created","author":"Austin Songer @austinsonger","status":"test","level":"low","date":"2021-07-24","modified":"2022-10-09","description":"Detects when an ElastiCache security group has been created.","references":["https://github.com/elastic/detection-rules/blob/598f3d7e0a63221c0703ad9a0ea7e22e7bc5961e/rules/integrations/aws/persistence_elasticache_security_group_creation.toml"],"logsource":{"product":"aws","service":"cloudtrail"},"tags":["attack.persistence","attack.t1136","attack.t1136.003"],"path":"rules/cloud/aws/cloudtrail/aws_elasticache_security_group_created.yml","techniques":["T1136","T1136.003"],"cves":[]},{"id":"b28e4eb3-8bbc-4f0c-819f-edfe8e2f25db","title":"ESXi Account Creation Via ESXCLI","author":"Cedric Maurugeon","status":"test","level":"medium","date":"2023-08-22","modified":null,"description":"Detects user account creation on ESXi system via esxcli","references":["https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_system.html"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.persistence","attack.execution","attack.t1136","attack.t1059.012"],"path":"rules/linux/process_creation/proc_creation_lnx_esxcli_user_account_creation.yml","techniques":["T1136","T1059.012"],"cves":[]},{"id":"e31bae15-83ed-473e-bf31-faf4f8a17d36","title":"New Kubernetes Service Account Created","author":"Leo Tsaousis (@laripping)","status":"test","level":"low","date":"2024-03-26","modified":null,"description":"Detects creation of new Kubernetes service account, which could indicate an attacker's attempt to persist within a cluster.\n","references":["https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/container%20service%20account/"],"logsource":{"product":"kubernetes","category":"application","service":"audit"},"tags":["attack.persistence","attack.t1136"],"path":"rules/application/kubernetes/audit/kubernetes_audit_serviceaccount_creation.yml","techniques":["T1136"],"cves":[]}],"kev_cves":[{"cveID":"CVE-2025-31161","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2023-20198","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2023-22515","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2023-35078","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2023-27997","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2023-34362","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2023-28252","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2021-44077","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2021-34473","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2021-40539","state":"mapped","mapping_types":["secondary_impact"]}],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}