Cross-source coverage

T1136.001 / ATT&CK

Create Account: Local Account

55 rules across 7 sources.

From MITRE ATT&CK 19.2

Adversaries may create a local account to maintain access to victim systems. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service.

For example, with a sufficient level of access, the Windows net user /add command can be used to create a local account. In Linux, the useradd command can be used, while on macOS systems, the dscl -create command can be used. Local accounts may also be added to network devices, often via common Network Device CLI commands such as username, to ESXi servers via esxcli system account add, or to Kubernetes clusters using the kubectl utility.

Adversaries may also create new local accounts on network firewall management consoles – for example, by exploiting a vulnerable firewall management system, threat actors may be able to establish super-admin accounts that could be used to modify firewall rules and gain further access to the network.

Such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.

Tactics: Persistence
Platforms: Containers · ESXi · Linux · macOS · Network Devices · Windows
Telemetry: WinEventLog:SecurityWinEventLog:Sysmonauditd:SYSCALLmacos:unifiedlogesxi:vmkernelebpf:syscallsnetworkdevice:syslog

How MITRE says to detect it DET0447

T1136.001 Detection Strategy - Local Account Creation Across Platforms

Windows Analytic 1235

Adversary uses built-in tools like 'net user /add', PowerShell, or WMI to create a local user. Sequence: Account creation event (4720) follows process creation of a suspicious executable (e.g., powershell.exe or net.exe).

WinEventLog:Security EventCode=4720
WinEventLog:Sysmon EventCode=1

Linux Analytic 1236

Local user accounts are created via binaries like 'useradd', 'adduser', or by editing passwd/shadow. Behavior chain includes execution of user management binaries or modification of user database files.

auditd:SYSCALL useradd or adduser executed
auditd:SYSCALL write operation on /etc/passwd or /etc/shadow

macOS Analytic 1237

Account creation using 'dscl -create' or via GUI tools. Detection involves command execution and file changes to the local directory services database.

macos:unifiedlog dscl -create
macos:unifiedlog modification to /var/db/dslocal/nodes/Default/users/

ESXi Analytic 1238

Account created using esxcli commands. Sequence includes esxcli execution and successful modification to account DB.

esxi:vmkernel esxcli system account add

Containers Analytic 1239

Account created in a running container (e.g., via 'useradd' or by modifying /etc/passwd directly). Detectable via runtime telemetry (e.g., Falco or eBPF hooks).

ebpf:syscalls useradd or /etc/passwd modified inside container

Network Devices Analytic 1240

Account created via CLI using 'username' command or REST API. Detectable through AAA logging or CLI history telemetry.

networkdevice:syslog username <user> privilege <level>

View on attack.mitre.org ↗

SigmaHQ/sigma

18 rules

Detection	Severity	Format
Serv-U Exploitation CVE-2021-35211 by DEV-0322	Critical	Sigma
Cisco Local Accounts	High	Sigma
Creation of a Local Hidden User Account by Registry	High	Sigma
DarkGate - User Created Via Net.EXE	High	Sigma
Hidden Local User Creation	High	Sigma
New User Created Via Net.EXE With Never Expire Option	High	Sigma
Privileged User Has Been Created	High	Sigma
Suspicious Windows ANONYMOUS LOGON Local Account Created	High	Sigma
User Added to Remote Desktop Users Group	High	Sigma
Creation Of An User Account	Medium	Sigma

+ 8 more from SigmaHQ/sigma → showing the 10 highest-severity

elastic/detection-rules

15 rules

Detection	Severity	Format
Creation of a Hidden Local User Account	High	Elastic TOML
FortiGate SSO Login Followed by Administrator Account Creation	High	Elastic TOML
Potential Linux Backdoor User Account Creation	High	Elastic TOML
FortiGate Administrator Account Creation from Unusual Source	Medium	Elastic TOML
FortiGate Super Admin Account Creation	Medium	Elastic TOML
OpenSSL Password Hash Generation	Medium	Elastic TOML
Potential Hidden Local User Account Creation	Medium	Elastic TOML
Suspicious Passwd File Event Action	Medium	Elastic TOML
Linux Group Creation	Low	Elastic TOML
Linux User Account Creation	Low	Elastic TOML

+ 5 more from elastic/detection-rules → showing the 10 highest-severity

splunk/security_content

13 rules

Detection	Severity	Format
Cisco ASA - New Local User Account Created	Undefined	SPL
Detect New Local Admin account	Undefined	SPL
ESXi Account Modified	Undefined	SPL
Linux Add User Account	Undefined	SPL
Linux Auditd Add User Account	Undefined	SPL
Linux Auditd Add User Account Type	Undefined	SPL
Short Lived Windows Accounts	Undefined	SPL
Windows Create Local Account	Undefined	SPL
Windows Create Local Administrator Account Via Net	Undefined	SPL
Windows ESX Admins Group Creation Security Event	Undefined	SPL

+ 3 more from splunk/security_content → showing the 10 highest-severity

socfortress/Wazuh-Rules

4 rules

Detection	Severity	Format
Privileged user account creation detected — possible local account persistence (T1136.001)	High	Wazuh XML
Root-level user creation detected via useradd -g 0 — possible privilege escalation	High	Wazuh XML
Local user account creation detected via useradd with comment 'evil_account'	Medium	Wazuh XML
User creation attempt via sudo detected (useradd)	Medium	Wazuh XML

Bert-JanP/Hunting-Queries-Detection-Rules

3 rules

Detection	Severity	Format
Local Account Created	Undefined	KQL
Local Administrator Additions	Undefined	KQL
MITRE ATT&CK Mapping	Undefined	KQL

Wazuh Core Ruleset

1 rule

Detection	Severity	Format
executed a user creation command · win.eventdata.commandLine = (?i)add\s	High	Wazuh XML

chronicle/detection-rules

1 rule

Detection	Severity	Format
new_user_created_via_net_exe	Medium	YARA-L