kevmap

Techniques › T1136 › T1136.002

T1136.002 Domain Account

persistence — Linux, macOS, Windows · attack.mitre.org · JSON

1
MITRE detection strategy
3
analytics
6
Sigma rules tagged attack.t1136.002
0
KEV CVEs mapped here
<p>Adversaries may create a domain account to maintain access to victim systems. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover user, administrator, and service accounts. With a sufficient level of access, the <code>net user /add /domain</code> command can be used to create a domain account.</p><p>Such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.</p>

KEV CVEs mapped to this technique · CTID Mappings Explorer

None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.

Detection strategy · ATT&CK Enterprise v19.2

Sigma rules · SigmaHQ da9bb07d64, tag attack.t1136.002

Suspicious Windows ANONYMOUS LOGON Local Account Created hightest
Author: James Pemberton / @4A616D6573 · 2019-10-31 (modified 2022-10-09) · logsource: product=windows service=security · 1bbf25b9-8038-4154-a50b-118f2a32be27
Detects the creation of suspicious accounts similar to ANONYMOUS LOGON, such as using additional spaces. Created as an covering detection for exclusion of Logon Type 3 from ANONYMOUS LOGON accounts.
Techniques: T1136.001T1136.002
PSEXEC Remote Execution File Artefact hightest
Author: Nasreddine Bencherchali (Nextron Systems) · 2023-01-21 (modified 2023-02-23) · logsource: product=windows category=file_event · 304afd73-55a5-4bb9-8c21-0b1fc84ea9e4
Detects creation of the PSEXEC key file. Which is created anytime a PsExec command is executed. It gets written to the file system and will be recorded in the USN Journal on the target system
Techniques: T1136.002T1543.003T1570
New User Account Creation Attempt Via ADSI in CommandLine mediumexperimental
Author: William Gokah (idea), Raylee Hawkins, Swachchhanda Shrawan Poudel (Nextron Systems) · 2026-08-13 · logsource: product=windows category=process_creation · 7c9fed65-039a-4055-8c23-fa763d94aff6
Detects PowerShell command line arguments containing ADSI (Active Directory Service Interfaces) patterns trying to create a new user account via the WinNT or LDAP provider. This is an uncommon method to create user accounts and may indicate an attempt to evade detection by avoiding more commonly monitored commands such as "net user", "New-LocalUser" or "New-ADUser".
Techniques: T1136.001T1136.002
Manipulation of User Computer or Group Security Principals Across AD mediumtest
Author: frack113 · 2021-12-28 · logsource: product=windows category=ps_script · b29a93fb-087c-4b5b-a84d-ee3309e69d08
Adversaries may create a domain account to maintain access to victim systems. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain..
Techniques: T1136.002
New User Account Creation Attempt Via ADSI mediumexperimental
Author: William Gokah (idea), Raylee Hawkins, Swachchhanda Shrawan Poudel (Nextron Systems) · 2026-08-13 · logsource: product=windows category=ps_script · e50d5d26-0cf6-4045-b82b-13c0a4e316be
Detects an attempt to create a new user account via ADSI (Active Directory Service Interfaces) using either the WinNT or LDAP provider. This is an uncommon method to create user accounts and may indicate an attempt to evade detection by avoiding more commonly monitored commands such as "net user", "New-LocalUser" or "New-ADUser".
Techniques: T1136.001T1136.002
ADCS - Certighost Ghost Machine Account Creation highexperimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2026-07-30 · logsource: product=windows service=security · fa0bac5f-d170-4a91-9780-1ad71dc1f49e
Detects the creation of a machine account whose name starts with 'GHOST', which is the naming convention used by the CVE-2026-54121 (Certighost) exploit tooling. The public proof-of-concept for Certighost creates a temporary machine account with a name of the form GHOST<random>$ before enrolling for a DC certificate via the cdc chase path. The attacker-controlled machine account is used as the requester identity in the certificate request; the cdc attribute then redirects the CA to a rogue host that returns a forged Domain Controller identity. The resulting certificate carries the DC's SID and DNS name, enabling full PKINIT authentication as the targeted DC followed by DCSync. A machine account creation event (4741) where TargetUserName starts with 'GHOST' and ends with '$' is a high-fidelity indicator of this attack tool's execution. Legitimate environments very rarely provision machine accounts with this prefix.
Techniques: T1136.002T1649
CVE tags: CVE-2026-54121

Rules tagged at the parent level (attack.t1136) 3

These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.

AWS ElastiCache Security Group Created lowtest
Author: Austin Songer @austinsonger · 2021-07-24 (modified 2022-10-09) · logsource: product=aws service=cloudtrail · 4ae68615-866f-4304-b24b-ba048dfa5ca7
Detects when an ElastiCache security group has been created.
Techniques: T1136T1136.003
ESXi Account Creation Via ESXCLI mediumtest
Author: Cedric Maurugeon · 2023-08-22 · logsource: product=linux category=process_creation · b28e4eb3-8bbc-4f0c-819f-edfe8e2f25db
Detects user account creation on ESXi system via esxcli
Techniques: T1136T1059.012
New Kubernetes Service Account Created lowtest
Author: Leo Tsaousis (@laripping) · 2024-03-26 · logsource: product=kubernetes category=application service=audit · e31bae15-83ed-473e-bf31-faf4f8a17d36
Detects creation of new Kubernetes service account, which could indicate an attacker's attempt to persist within a cluster.
Techniques: T1136