MITRE ATT&CKtechnique

T1136 Create Account

Published 2017-12-14 Modified 2025-10-24 Official page ↗

Domain: enterprise
Tactics: Persistence
Platforms: Windows, IaaS, Linux, macOS, Network Devices, Containers, SaaS, Office Suite, Identity Provider, ESXi
Version: 2.6
Created: 2017-12-14

Description

Adversaries may create an account to maintain access to victim systems. With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system. Accounts may be created on the local system or within a domain or cloud tenant. In cloud environments, adversaries may create accounts that only have access to specific services, which can reduce the chance of detection.

Tactic · MITRE ATT&CK (1)

TA0003 Persistence tactic

Referenced by MITRE ATT&CK · mitigates (4)

M1030 Network Segmentation mitigation
M1032 Multi-factor Authentication mitigation
M1026 Privileged Account Management mitigation
M1028 Operating System Configuration mitigation

Referenced by MITRE ATT&CK · subtechnique of (3)

T1136.003 Cloud Account sub-technique
T1136.001 Local Account sub-technique
T1136.002 Domain Account sub-technique

Referenced by MITRE ATT&CK · uses (5)

G1045 Salt Typhoon group
S1199 LockBit 2.0 software (malware)
G1015 Scattered Spider group
C0025 2016 Ukraine Electric Power Attack campaign
G0119 Indrik Spider group

Referenced by Compliance · mitigates (17)

CIS-16.8 Separate Production and Non-Production Systems CIS Safeguard v8.1
CIS-6.5 Require MFA for Administrative Access CIS Safeguard v8.1
NIST-AC-2 Account Management NIST 800-53 control
NIST-AC-20 Use of External Systems NIST 800-53 control
NIST-AC-3 Access Enforcement NIST 800-53 control
NIST-AC-4 Information Flow Enforcement NIST 800-53 control
NIST-AC-5 Separation of Duties NIST 800-53 control
NIST-AC-6 Least Privilege NIST 800-53 control
NIST-CM-5 Access Restrictions for Change NIST 800-53 control
NIST-CM-6 Configuration Settings NIST 800-53 control
NIST-CM-7 Least Functionality NIST 800-53 control
NIST-IA-2 Identification and Authentication (Organizational Users) NIST 800-53 control
NIST-IA-5 Authenticator Management NIST 800-53 control
NIST-SC-46 Cross Domain Policy Enforcement NIST 800-53 control
NIST-SC-7 Boundary Protection NIST 800-53 control
NIST-SI-4 System Monitoring NIST 800-53 control
NIST-SI-7 Software, Firmware, and Information Integrity NIST 800-53 control

References

https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4720 Microsoft User Creation Event
https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/wastedlocker-ransomware-us Symantec WastedLocker June 2020