MITRE ATT&CKsub-technique

T1136.002 Domain Account

Published 2020-01-28 Modified 2025-10-24 Official page ↗
Domain
enterprise
Tactics
Persistence
Platforms
Linux, macOS, Windows
Version
1.1
Created
2020-01-28

Description

Adversaries may create a domain account to maintain access to victim systems. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover user, administrator, and service accounts. With a sufficient level of access, the net user /add /domain command can be used to create a domain account. Such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1136 Create Account technique

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (4)

  • M1030 Network Segmentation mitigation
  • M1032 Multi-factor Authentication mitigation
  • M1026 Privileged Account Management mitigation
  • M1028 Operating System Configuration mitigation

Referenced by MITRE ATT&CK · uses (11)

  • G1051 Medusa Group group
  • G1043 BlackByte group
  • C0028 2015 Ukraine Electric Power Attack campaign
  • C0025 2016 Ukraine Electric Power Attack campaign
  • G0125 HAFNIUM group
  • G0102 Wizard Spider group
  • G0093 GALLIUM group
  • S0363 Empire software (tool)
  • S0192 Pupy software (tool)
  • S0029 PsExec software (tool)
  • S0039 Net software (tool)

Referenced by Compliance · mitigates (17)

  • CIS-16.8 Separate Production and Non-Production Systems CIS Safeguard v8.1
  • CIS-6.5 Require MFA for Administrative Access CIS Safeguard v8.1
  • NIST-AC-2 Account Management NIST 800-53 control
  • NIST-AC-20 Use of External Systems NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-4 Information Flow Enforcement NIST 800-53 control
  • NIST-AC-5 Separation of Duties NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-CM-5 Access Restrictions for Change NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-CM-7 Least Functionality NIST 800-53 control
  • NIST-IA-2 Identification and Authentication (Organizational Users) NIST 800-53 control
  • NIST-IA-5 Authenticator Management NIST 800-53 control
  • NIST-SC-46 Cross Domain Policy Enforcement NIST 800-53 control
  • NIST-SC-7 Boundary Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control
  • NIST-SI-7 Software, Firmware, and Information Integrity NIST 800-53 control

References