Adversaries may create an account to maintain access to victim systems. With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
Accounts may be created on the local system or within a domain or cloud tenant. In cloud environments, adversaries may create accounts that only have access to specific services, which can reduce the chance of detection.
View in MITRE ATT&CK®Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
---|---|---|---|---|---|
identityplatform | IdentityPlatform | technique_scores | T1136 | Create Account |
Comments
Identity Platform multi-tenancy uses tenants to create unique silos of users and configurations within a single Identity Platform project. It provides provides secure, easy-to-use authentication if you're building a service on Google Cloud, on your own backend or on another platform; thereby, helping to mitigate adversaries from gaining access to systems.
References
|
chronicle | Chronicle | technique_scores | T1136 | Create Account |
Comments
Chronicle is able to trigger based on suspicious system event logs, such as newly created local user accounts on Windows machines.
This technique was scored as minimal based on low or uncertain detection coverage factor.
https://github.com/chronicle/detection-rules/blob/783e0e5947774785db1c55041b70176deeca6f46/soc_prime_rules/threat_hunting/windows/detects_local_user_creation.yaral
References
|
advancedprotectionprogram | AdvancedProtectionProgram | technique_scores | T1136 | Create Account |
Comments
Advanced Protection Program enables the use of a security key for multi-factor authentication. Enabling Advanced Protection Program for all users at an organization can prevent adversaries from maintaining access via created accounts because any accounts they create won't have the required security keys for MFA.
References
|
Technique ID | Technique Name | Number of Mappings |
---|---|---|
T1136.003 | Cloud Account | 3 |
T1136.002 | Domain Account | 1 |
T1136.001 | Local Account | 2 |