{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1136","id":"T1136","name":"Create Account","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1136","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"a656c0bdc3a141384ddfbd54b7403bca5a0bb8c404b09a6b447d8d390f9ae86a","description":"Adversaries may create an account to maintain access to victim systems.(Citation: Symantec WastedLocker June 2020) With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.\n\nAccounts may be created on the local system or within a domain or cloud tenant. In cloud environments, adversaries may create accounts that only have access to specific services, which can reduce the chance of detection.","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1136","external_id":"T1136"},{"source_name":"Microsoft User Creation Event","description":"Lich, B., Miroshnikov, A. (2017, April 5). 4720(S): A user account was created. Retrieved June 30, 2017.","url":"https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4720"},{"source_name":"Symantec WastedLocker June 2020","description":"Symantec Threat Intelligence. (2020, June 25). WastedLocker: Symantec Identifies Wave of Attacks Against U.S. Organizations. Retrieved May 20, 2021.","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/wastedlocker-ransomware-us"}],"platforms":["Windows","IaaS","Linux","macOS","Network Devices","Containers","SaaS","Office Suite","Identity Provider","ESXi"],"environments":["cloud","cloud-hosted-endpoint","containers","identity","network-infrastructure","onprem","saas","virtualization"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[{"key":"enterprise/T1136.001","id":"T1136.001","name":"Local Account","page":"techniques/enterprise/T1136.001/"},{"key":"enterprise/T1136.002","id":"T1136.002","name":"Domain Account","page":"techniques/enterprise/T1136.002/"},{"key":"enterprise/T1136.003","id":"T1136.003","name":"Cloud Account","page":"techniques/enterprise/T1136.003/"}],"telemetry":[{"id":"DC0064","name":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component","category":"Script and command execution","description":"Execution of a command and its interpreter or parent context.","collection_focus":"Collect process command lines and relevant shell/interpreter audit; shell history alone is neither complete nor tamper-resistant.","providers":[{"name":"PowerShell Script Block Logging","scope":"Script content via event 4104 when configured; channel depends on PowerShell edition.","source_id":"powershell"},{"name":"Sysmon process events","scope":"Interpreter launch and parent context, not full script content.","source_id":"sysmon"},{"name":"Linux Audit","scope":"execve-family execution context; shell built-ins need additional instrumentation.","source_id":"linux"}],"configuration":["Enable Script Block Logging through the policy/configuration for the installed edition. Forward Microsoft-Windows-PowerShell/Operational for Windows PowerShell, or PowerShellCore/Operational for PowerShell 7.","Retain script-block ID and fragment ordering alongside process creation. Protect access to collected script text; secrets may be included.","On Linux, use narrowly scoped Audit execution rules for the lab account and supported architectures, and retain joined SYSCALL/EXECVE/PATH records."],"configuration_example":null,"required_fields":["interpreter","command_line","actor_uid","session_id"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Script content and process command lines are different signals. Logging may be partial, fragmented, filtered or disabled; never assume a command line reveals everything executed.","sources":[{"id":"powershell","title":"Microsoft PowerShell logging on Windows","url":"https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows?view=powershell-7.5"},{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Per host role and principal: rare interpreters, command argument patterns and parent-child sequences. Normalize scripts carefully; obfuscation, administrative automation and missing command lines change visibility."},{"id":"DC0061","name":"File Modification","page":"telemetry/DC0061/","kind":"attack_component","category":"Endpoint activity","description":"Changes to file data or attributes.","collection_focus":"Use file-integrity monitoring or scoped OS file-write auditing for general changes. Sysmon 2 records creation-time changes; it is not a general file-write event.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["path","attribute","before","after"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0061","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","attribute":"content_hash","before":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","after":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0014","name":"User Account Creation","page":"telemetry/DC0014/","kind":"attack_component","category":"Windows and directory audit","description":"Creation of a local or directory user account.","collection_focus":"Enable Audit User Account Management and collect actor, account ID, account type and outcome from the system creating the account.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"},{"name":"Active Directory domain controllers","scope":"Directory changes and authentication records; collect from the relevant controllers, not only endpoints.","source_id":"ad"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["actor","account_id","account_type","action"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0014","collector":"illustrative-lab-collector","observation":{"actor":"lab-admin","account_id":"user-lab-2","account_type":"local","action":"create"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."},{"id":"DC0010","name":"User Account Modification","page":"telemetry/DC0010/","kind":"attack_component","category":"Windows and directory audit","description":"Modification of an account attribute, policy or enabled state.","collection_focus":"Enable Audit User Account Management and retain the changed attributes and target account; correlate approved administrative requests.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"},{"name":"Active Directory domain controllers","scope":"Directory changes and authentication records; collect from the relevant controllers, not only endpoints.","source_id":"ad"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["target_account","attribute","before","after"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0010","collector":"illustrative-lab-collector","observation":{"target_account":"lab-temp","attribute":"enabled","before":false,"after":true}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."}],"detection":{"key":"enterprise/T1136","id":"T1136","name":"Create Account","domain":"enterprise","platforms":["Windows","IaaS","Linux","macOS","Network Devices","Containers","SaaS","Office Suite","Identity Provider","ESXi"],"environments":["cloud","cloud-hosted-endpoint","containers","identity","network-infrastructure","onprem","saas","virtualization"],"source_url":"https://attack.mitre.org/techniques/T1136","technique_page":"techniques/enterprise/T1136/","page":"detections/enterprise/T1136/","status":"rule_source_available","counts":{"sigma":3,"atlas_basic":1,"atlas_anomaly":1,"strategies":1,"analytics":5,"live_validated":0},"sigma_rules":[{"id":"e31bae15-83ed-473e-bf31-faf4f8a17d36","title":"New Kubernetes Service Account Created","status":"test","level":"low","logsource":{"category":"application","product":"kubernetes","service":"audit"},"data_path":"data/detection-rules/e31bae15-83ed-473e-bf31-faf4f8a17d36.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/kubernetes/audit/kubernetes_audit_serviceaccount_creation.yml","author":"Leo Tsaousis (@laripping)","kind":"sigma"},{"id":"4ae68615-866f-4304-b24b-ba048dfa5ca7","title":"AWS ElastiCache Security Group Created","status":"test","level":"low","logsource":{"product":"aws","service":"cloudtrail"},"data_path":"data/detection-rules/4ae68615-866f-4304-b24b-ba048dfa5ca7.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/aws/cloudtrail/aws_elasticache_security_group_created.yml","author":"Austin Songer @austinsonger","kind":"sigma"},{"id":"b28e4eb3-8bbc-4f0c-819f-edfe8e2f25db","title":"ESXi Account Creation Via ESXCLI","status":"test","level":"medium","logsource":{"category":"process_creation","product":"linux"},"data_path":"data/detection-rules/b28e4eb3-8bbc-4f0c-819f-edfe8e2f25db.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_esxcli_user_account_creation.yml","author":"Cedric Maurugeon","kind":"sigma"}],"atlas_basic":[{"id":"atlas-basic-t1136-1","technique_id":"T1136","title":"T1136 Create Account","kind":"basic","source_url":"https://1200km.com/anomaly-detection-atlas/attack-basic-detection-rule-catalog/#persistence","source_path":"docs/attack-basic-detection-rule-catalog.md","source_line":72,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-basic-detection-rule-catalog.md#L72","source_file_sha256":"396a87e3d8da74d170684c0f377fe5dc11cd1a486d4f2f89f7fbe94deaaa2a1e","source_row_sha256":"40eeeed32872423a2da65dfc3b126dc7b4ff40f0f0c33edb9a2a25059137d087","validation":"published_concept_not_executable_or_live_validated","logic":"MATCH(account_created) AND creator NOT_IN approved_account_provisioners -> ALERT","log_sources":[{"title":"Windows Security Event Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#23-windows-security-event-logs"},{"title":"Directory-Service Audit Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#42-directory-service-audit-logs"},{"title":"Identity Provider Audit Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#40-identity-provider-audit-logs"}]}],"atlas_anomaly":[{"id":"atlas-anomaly-t1136-1","technique_id":"T1136","title":"New local, domain, cloud, or service account — T1136 Create Account","kind":"anomaly","source_url":"https://1200km.com/anomaly-detection-atlas/attack-statistical-anomaly-mapping/#account-creation","source_path":"docs/attack-statistical-anomaly-mapping.md","source_line":54,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-statistical-anomaly-mapping.md#L54","source_file_sha256":"9d38eaa6306863918e8193f267fb063270260e50b013928dc97893d5e74bf144","source_row_sha256":"364752ac9088de03caf0245ef3df3c185ffe140989356498e752a83247a8c4e5","validation":"published_concept_not_executable_or_live_validated","comparison_unit":"creator, target account type, and time.","expected_behavior":"account creation is performed by a small set of provisioning identities following recurring workflows.","deviation":"rare creator, unusual account type, or creation outside expected sequence.","anomaly_types":[{"title":"Peer-Group Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#8-peer-group-anomaly"},{"title":"Rare-Category Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#84-rare-category-anomaly"},{"title":"Transition Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#61-transition-anomaly"}],"log_sources":[{"title":"Directory-Service Audit Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#42-directory-service-audit-logs"},{"title":"Identity Provider Audit Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#40-identity-provider-audit-logs"}],"context_references":[{"title":"Scattered Spider joint advisory — downloaded copy","url":"https://1200km.com/anomaly-detection-atlas/reports/cti-ir/fbi-aa23-320a-scattered-spider.pdf"},{"title":"original source","url":"https://www.ic3.gov/CSA/2023/231116.pdf"}]}],"anomaly_types":[{"title":"Peer-Group Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#8-peer-group-anomaly"},{"title":"Rare-Category Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#84-rare-category-anomaly"},{"title":"Transition Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#61-transition-anomaly"}],"strategies":[{"id":"DET0583","name":"Detection Strategy for T1136 - Create Account across platforms","url":"https://attack.mitre.org/detectionstrategies/DET0583","stix_id":"x-mitre-detection-strategy--552bacaa-9df5-4c95-83de-a7d1948003b5","relationship_id":"relationship--bd9b60eb-dc7a-4806-b882-040b17e4f5b4","description":"","analytics":[{"id":"AN1604","name":"Analytic 1604","guidance":"Adversary uses built-in OS tools or API calls to create local or domain accounts for persistence or lateral movement. Tools such as 'net user', PowerShell, or MMC snap-ins may be used. Detection focuses on Event ID 4720 paired with process lineage and user context.","url":"https://attack.mitre.org/detectionstrategies/DET0583#AN1604","platforms":["Windows"],"tuning":[{"field":"TimeWindow","description":"Correlation between Event ID 4720 and creating process may vary by environment and automation delays"},{"field":"ParentProcessName","description":"Tools like net.exe or powershell.exe can be normal or malicious depending on user context"},{"field":"UserContext","description":"System vs. administrator vs. low-privilege user context changes alert criticality"}],"log_sources":[{"component_id":"DC0014","component":"User Account Creation","name":"WinEventLog:Security","channel":"EventCode=4720","platforms":["Windows"],"analytic_id":"AN1604","source_url":"https://attack.mitre.org/detectionstrategies/DET0583#AN1604","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0014/"},{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Sysmon","channel":"EventCode=1","platforms":["Windows"],"analytic_id":"AN1604","source_url":"https://attack.mitre.org/detectionstrategies/DET0583#AN1604","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"}]},{"id":"AN1605","name":"Analytic 1605","guidance":"Adversary invokes 'useradd', 'adduser', or equivalent system commands or scripts to create local users. Detection focuses on command execution and audit trail of passwd/shadow file modifications.","url":"https://attack.mitre.org/detectionstrategies/DET0583#AN1605","platforms":["Linux"],"tuning":[{"field":"BinaryPath","description":"Custom scripts or renamed binaries may evade simple path-based detection"},{"field":"ExecutionTime","description":"Account creation outside maintenance windows may indicate compromise"}],"log_sources":[{"component_id":"DC0014","component":"User Account Creation","name":"auditd:SYSCALL","channel":"useradd or adduser executed","platforms":["Linux"],"analytic_id":"AN1605","source_url":"https://attack.mitre.org/detectionstrategies/DET0583#AN1605","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0014/"},{"component_id":"DC0061","component":"File Modification","name":"auditd:SYSCALL","channel":"chmod/chown to /etc/passwd or /etc/shadow","platforms":["Linux"],"analytic_id":"AN1605","source_url":"https://attack.mitre.org/detectionstrategies/DET0583#AN1605","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0061/"}]},{"id":"AN1606","name":"Analytic 1606","guidance":"Adversary creates new users using 'dscl' commands, GUI tools, or by modifying user plist files. Detection includes monitoring dscl invocation and user-related plist changes.","url":"https://attack.mitre.org/detectionstrategies/DET0583#AN1606","platforms":["macOS"],"tuning":[{"field":"UsernamePattern","description":"Attackers may use service-like names to hide malicious accounts"},{"field":"ExecutionSource","description":"Accounts created via Terminal vs GUI vs remote session can affect confidence"}],"log_sources":[{"component_id":"DC0064","component":"Command Execution","name":"macos:unifiedlog","channel":"dscl . -create","platforms":["macOS"],"analytic_id":"AN1606","source_url":"https://attack.mitre.org/detectionstrategies/DET0583#AN1606","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"},{"component_id":"DC0061","component":"File Modification","name":"macos:unifiedlog","channel":"modification to /var/db/dslocal/nodes/Default/users/","platforms":["macOS"],"analytic_id":"AN1606","source_url":"https://attack.mitre.org/detectionstrategies/DET0583#AN1606","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0061/"}]},{"id":"AN1607","name":"Analytic 1607","guidance":"Adversary creates users via IAM/IdP API or portal (e.g., Azure AD, Okta). Detection involves monitoring API calls, admin action logs, and correlation with role assignments.","url":"https://attack.mitre.org/detectionstrategies/DET0583#AN1607","platforms":["Identity Provider"],"tuning":[{"field":"AdminThreshold","description":"Trigger alert only when account is assigned privileged roles"},{"field":"AutomationExemptions","description":"Exclude accounts from known automation processes or provisioning pipelines"}],"log_sources":[{"component_id":"DC0014","component":"User Account Creation","name":"azure:audit","channel":"Add user","platforms":["Identity Provider"],"analytic_id":"AN1607","source_url":"https://attack.mitre.org/detectionstrategies/DET0583#AN1607","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0014/"}]},{"id":"AN1608","name":"Analytic 1608","guidance":"Account creation via cloud service APIs or CLI, often associated with key generation. Monitored via CloudTrail or equivalent audit logs.","url":"https://attack.mitre.org/detectionstrategies/DET0583#AN1608","platforms":["IaaS"],"tuning":[{"field":"Region","description":"Alert on account creation outside expected geographies"},{"field":"ServiceScope","description":"Filter on creation of users scoped to sensitive services"}],"log_sources":[{"component_id":"DC0014","component":"User Account Creation","name":"AWS:CloudTrail","channel":"CreateUser","platforms":["IaaS"],"analytic_id":"AN1608","source_url":"https://attack.mitre.org/detectionstrategies/DET0583#AN1608","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0014/"},{"component_id":"DC0010","component":"User Account Modification","name":"AWS:CloudTrail","channel":"AttachUserPolicy","platforms":["IaaS"],"analytic_id":"AN1608","source_url":"https://attack.mitre.org/detectionstrategies/DET0583#AN1608","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0010/"}]}]}],"telemetry_references":[{"id":"DC0064","name":"Command Execution","tag":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component"},{"id":"DC0061","name":"File Modification","tag":"File Modification","page":"telemetry/DC0061/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"},{"id":"DC0014","name":"User Account Creation","tag":"User Account Creation","page":"telemetry/DC0014/","kind":"attack_component"},{"id":"DC0010","name":"User Account Modification","tag":"User Account Modification","page":"telemetry/DC0010/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[{"id":"S1199","name":"LockBit 2.0","url":"https://attack.mitre.org/software/S1199","kind":"malware","description":"[LockBit 2.0](https://attack.mitre.org/software/S1199) has been observed creating accounts for persistence using simple names like \"a\".(Citation: Palo Alto Lockbit 2.0 JUN 2022)","relationship_id":"relationship--4b701171-23cd-41b0-9bde-3a1dfc236161","references":[{"source_name":"Palo Alto Lockbit 2.0 JUN 2022","description":"Elsad, A. et al. (2022, June 9). LockBit 2.0: How This RaaS Operates and How to Protect Against It. Retrieved January 24, 2025.","url":"https://unit42.paloaltonetworks.com/lockbit-2-ransomware/"}]}],"actors":[{"id":"G0119","name":"Indrik Spider","url":"https://attack.mitre.org/groups/G0119","kind":"intrusion-set","description":"[Indrik Spider](https://attack.mitre.org/groups/G0119) used <code>wmic.exe</code> to add a new user to the system.(Citation: Symantec WastedLocker June 2020)","relationship_id":"relationship--15033f82-efad-4db9-8d4c-015eeeeead64","references":[{"source_name":"Symantec WastedLocker June 2020","description":"Symantec Threat Intelligence. (2020, June 25). WastedLocker: Symantec Identifies Wave of Attacks Against U.S. Organizations. Retrieved May 20, 2021.","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/wastedlocker-ransomware-us"}]},{"id":"G1015","name":"Scattered Spider","url":"https://attack.mitre.org/groups/G1015","kind":"intrusion-set","description":"[Scattered Spider](https://attack.mitre.org/groups/G1015) creates new user identities within the compromised organization.(Citation: CISA Scattered Spider Advisory November 2023)","relationship_id":"relationship--cb094cb6-145c-471b-beac-0895a632bb57","references":[{"source_name":"CISA Scattered Spider Advisory November 2023","description":"CISA. (2023, November 16). Cybersecurity Advisory: Scattered Spider (AA23-320A). Retrieved March 18, 2024.","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a"}]},{"id":"G1045","name":"Salt Typhoon","url":"https://attack.mitre.org/groups/G1045","kind":"intrusion-set","description":"[Salt Typhoon](https://attack.mitre.org/groups/G1045) has created Linux-level users on compromised network devices through modification of `/etc/shadow` and `/etc/passwd`.(Citation: Cisco Salt Typhoon FEB 2025)","relationship_id":"relationship--ee068884-27e4-4ec1-ae33-ba3ae58fcdd5","references":[{"source_name":"Cisco Salt Typhoon FEB 2025","description":"Cisco Talos. (2025, February 20). Weathering the storm: In the midst of a Typhoon. Retrieved February 24, 2025.","url":"https://blog.talosintelligence.com/salt-typhoon-analysis/"}]}],"mitigations":[{"id":"M1026","name":"Privileged Account Management","url":"https://attack.mitre.org/mitigations/M1026","kind":"course-of-action","description":"Limit the number of accounts with permissions to create other accounts. Do not allow domain administrator accounts to be used for day-to-day operations that may expose them to potential adversaries on unprivileged systems.","relationship_id":"relationship--b465fe54-83e6-4d1c-b752-d13bb788c3ac","references":[]},{"id":"M1028","name":"Operating System Configuration","url":"https://attack.mitre.org/mitigations/M1028","kind":"course-of-action","description":"Protect domain controllers by ensuring proper security configuration for critical servers.","relationship_id":"relationship--6808a607-0c81-433b-a027-2f1a8fe163c9","references":[]},{"id":"M1030","name":"Network Segmentation","url":"https://attack.mitre.org/mitigations/M1030","kind":"course-of-action","description":"Configure access controls and firewalls to limit access to domain controllers and systems used to create and manage accounts.","relationship_id":"relationship--26099ea8-5af8-4173-b70d-b32bbcbe0732","references":[]},{"id":"M1032","name":"Multi-factor Authentication","url":"https://attack.mitre.org/mitigations/M1032","kind":"course-of-action","description":"Use multi-factor authentication for user and privileged accounts.","relationship_id":"relationship--a3012b2b-b19c-46fc-944c-d04d9c4b897b","references":[]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1136":"/ttp-simulation/techniques/enterprise/T1136/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1136","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0061","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","attribute":"content_hash","before":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","after":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0014","collector":"illustrative-lab-collector","observation":{"actor":"lab-admin","account_id":"user-lab-2","account_type":"local","action":"create"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0010","collector":"illustrative-lab-collector","observation":{"target_account":"lab-temp","attribute":"enabled","before":false,"after":true}}]}}