Techniques › T1136 › T1136.001
T1136.001 Local Account
persistence — Containers, ESXi, Linux, macOS, Network Devices, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
6
analytics
18
Sigma rules tagged attack.t1136.001
2
KEV CVEs mapped here
<p>Adversaries may create a local account to maintain access to victim systems. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service.</p><p>For example, with a sufficient level of access, the Windows <code>net user /add</code> command can be used to create a local account. In Linux, the
useradd command can be used, while on macOS systems, the <code>dscl -create</code> command can be used. Local accounts may also be added to network devices, often via common Network Device CLI commands such as <code>username</code>, to ESXi servers via esxcli system account add, or to Kubernetes clusters using the kubectl utility.</p><p>Adversaries may also create new local accounts on network firewall management consoles – for example, by exploiting a vulnerable firewall management system, threat actors may be able to establish super-admin accounts that could be used to modify firewall rules and gain further access to the network.</p><p>Such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.</p>KEV CVEs mapped to this technique · CTID Mappings Explorer
| CVE | Vendor / product | Mapping type | State | Added |
|---|---|---|---|---|
| CVE-2022-47966 | Zoho ManageEngine | primary impact | Mapped | 2023-01-23 |
| CVE-2022-21999 | Microsoft Windows | secondary impact | Mapped | 2022-03-25 |
Detection strategy · ATT&CK Enterprise v19.2
- DET0447 T1136.001 Detection Strategy - Local Account Creation Across Platforms v1.0
AN1235 WindowsAdversary uses built-in tools like 'net user /add', PowerShell, or WMI to create a local user. Sequence: Account creation event (4720) follows process creation of a suspicious executable (e.g., powershell.exe or net.exe).Tunable:
ParentProcessNameTimeWindowUserContextAN1236 LinuxLocal user accounts are created via binaries like 'useradd', 'adduser', or by editing passwd/shadow. Behavior chain includes execution of user management binaries or modification of user database files.Tunable:BinaryPathExecutionSourceAN1237 macOSAccount creation using 'dscl -create' or via GUI tools. Detection involves command execution and file changes to the local directory services database.Tunable:UsernamePatternSessionOriginAN1238 ESXiAccount created using esxcli commands. Sequence includes esxcli execution and successful modification to account DB.Tunable:CommandOriginAN1239 ContainersAccount created in a running container (e.g., via 'useradd' or by modifying /etc/passwd directly). Detectable via runtime telemetry (e.g., Falco or eBPF hooks).Tunable:ContainerContextNamespaceScopeAN1240 Network DevicesAccount created via CLI using 'username' command or REST API. Detectable through AAA logging or CLI history telemetry.Tunable:PrivilegeLevelRemoteSessionFlag
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1136.001
Author: Pawel Mazur
· 2022-12-21 (modified 2025-01-21) · logsource: product=linux · 0ac15ec3-d24f-4246-aa2a-3077bb1cf90e
Detects the addition of a new user to a privileged group such as "root" or "sudo"
Author: James Pemberton / @4A616D6573
· 2019-10-31 (modified 2022-10-09) · logsource: product=windows service=security · 1bbf25b9-8038-4154-a50b-118f2a32be27
Detects the creation of suspicious accounts similar to ANONYMOUS LOGON, such as using additional spaces. Created as an covering detection for exclusion of Logon Type 3 from ANONYMOUS LOGON accounts.
Author: @ROxPinTeddy
· 2020-04-11 (modified 2022-12-25) · logsource: product=windows category=ps_script · 243de76f-4725-4f2e-8225-a8a69b15ad61
Detects creation of a local user via PowerShell
Author: Christian Burkard (Nextron Systems)
· 2021-05-03 (modified 2025-10-31) · logsource: product=windows category=registry_event · 460479f3-80b7-42da-9c43-2cc1d54dbccd
Sysmon registry detection of a local hidden user account.
Author: Alejandro Ortuno, oscd.community
· 2020-10-06 (modified 2023-02-18) · logsource: product=macos category=process_creation · 51719bf5-e4fd-4e44-8ba8-b830e7ac0731
Detects the creation of a new user account. Such accounts may be used for persistence that do not require persistent remote access tools to be deployed on the system.
Author: Patrick Bareiss
· 2019-04-18 (modified 2021-01-17) · logsource: product=windows service=security · 66b6be3d-55d0-4f47-9855-d69df21740ea
Detects local user creation on Windows servers, which shouldn't happen in an Active Directory environment. Apply this Sigma Use Case on your Windows server logs and not on your DC logs.
Author: Austin Clark
· 2019-08-12 (modified 2023-01-04) · logsource: product=cisco service=aaa · 6d844f0f-1c18-41af-8f19-33e7654edfc3
Find local accounts being created or modified as well as remote authentication configurations
Author: Florian Roth (Nextron Systems)
· 2021-07-14 (modified 2022-12-18) · logsource: product=windows category=process_creation · 75578840-9526-4b2a-9462-af469a45e767
Detects patterns as noticed in exploitation of Serv-U CVE-2021-35211 vulnerability by threat group DEV-0322
Author: Marie Euler, Pawel Mazur
· 2020-05-18 (modified 2022-12-20) · logsource: product=linux service=auditd · 759d0d51-bc99-4b5e-9add-8f5b2c8e7512
Detects the creation of a new user account. Such accounts may be used for persistence that do not require persistent remote access tools to be deployed on the system.
Author: Christian Burkard (Nextron Systems)
· 2021-05-03 (modified 2024-01-16) · logsource: product=windows service=security · 7b449a5e-1db5-4dd0-a2dc-4e3a67282538
Detects the creation of a local hidden user account which should not happen for event ID 4720.
Author: William Gokah (idea), Raylee Hawkins, Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-08-13 · logsource: product=windows category=process_creation · 7c9fed65-039a-4055-8c23-fa763d94aff6
Detects PowerShell command line arguments containing ADSI (Active Directory Service Interfaces) patterns
trying to create a new user account via the WinNT or LDAP provider. This is an uncommon method to create
user accounts and may indicate an attempt to evade detection by avoiding more commonly monitored commands
such as "net user", "New-LocalUser" or "New-ADUser".
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-07-12 (modified 2023-02-21) · logsource: product=windows category=process_creation · b9f0e6f5-09b4-4358-bae4-08408705bd5c
Detects creation of local users via the net.exe command with the option "never expire"
Author: X__Junior (Nextron Systems)
· 2023-08-27 (modified 2023-10-15) · logsource: product=windows category=process_creation · bf906d7b-7070-4642-8383-e404cf26eba5
Detects creation of local users via the net.exe command with the name of "DarkGate"
Author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber)
· 2025-11-01 · logsource: product=fortigate service=event · cd0a4943-0edd-42cf-b50c-06f77a10d4c1
Detects the creation of an administrator account on a Fortinet FortiGate Firewall.
Author: Endgame, JHasenbusch (adapted to Sigma for oscd.community)
· 2018-10-30 (modified 2023-02-21) · logsource: product=windows category=process_creation · cd219ff3-fa99-45d4-8380-a7d15116c6dc
Identifies the creation of local users via the net.exe command.
Author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber)
· 2025-11-01 · logsource: product=fortigate service=event · ddbbe845-1d74-43a8-8231-2156d180234d
Detects the creation of a new local user on a Fortinet FortiGate Firewall.
The new local user could be used for VPN connections.
Author: William Gokah (idea), Raylee Hawkins, Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-08-13 · logsource: product=windows category=ps_script · e50d5d26-0cf6-4045-b82b-13c0a4e316be
Detects an attempt to create a new user account via ADSI (Active Directory Service Interfaces)
using either the WinNT or LDAP provider. This is an uncommon method to create user accounts
and may indicate an attempt to evade detection by avoiding more commonly monitored commands
such as "net user", "New-LocalUser" or "New-ADUser".
Author: Florian Roth (Nextron Systems)
· 2021-12-06 (modified 2022-09-09) · logsource: product=windows category=process_creation · ffa28e60-bdb1-46e0-9f82-05f7a61cc06e
Detects addition of users to the local Remote Desktop Users group via "Net" or "Add-LocalGroupMember".
Rules tagged at the parent level (attack.t1136) 3
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: Austin Songer @austinsonger
· 2021-07-24 (modified 2022-10-09) · logsource: product=aws service=cloudtrail · 4ae68615-866f-4304-b24b-ba048dfa5ca7
Detects when an ElastiCache security group has been created.
Author: Cedric Maurugeon
· 2023-08-22 · logsource: product=linux category=process_creation · b28e4eb3-8bbc-4f0c-819f-edfe8e2f25db
Detects user account creation on ESXi system via esxcli
Author: Leo Tsaousis (@laripping)
· 2024-03-26 · logsource: product=kubernetes category=application service=audit · e31bae15-83ed-473e-bf31-faf4f8a17d36
Detects creation of new Kubernetes service account, which could indicate an attacker's attempt to persist within a cluster.