Cross-source coverage
T1136.002 / ATT&CK
Create Account: Domain Account
17 rules across 5 sources.
From MITRE ATT&CK 19.2
Adversaries may create a domain account to maintain access to victim systems. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover user, administrator, and service accounts. With a sufficient level of access, the net user /add /domain command can be used to create a domain account.
Such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
- Tactics
- Persistence
- Platforms
- Linux · macOS · Windows
- Telemetry
-
WinEventLog:SecurityWinEventLog:Sysmonauditd:SYSCALLNSM:Flowmacos:unifiedlog
How MITRE says to detect it DET0003
T1136.002 Detection Strategy - Domain Account Creation Across Platforms
Windows Analytic 0006
Adversary uses built-in tools such as 'net user /add /domain' or PowerShell to create a domain user account. The behavior chain includes: (1) suspicious process execution on a domain controller followed by (2) user account creation event (Event ID 4720) on the same host.
WinEventLog:SecurityEventCode=4720WinEventLog:SysmonEventCode=1
Linux Analytic 0007
Adversary with access to domain management tools (e.g., `realmd`, `samba-tool`, `ldapmodify`) creates a new domain user via command-line utilities. Behavior chain: LDAP command or script triggers → user entry added in AD via Kerberos/LDAP traffic.
auditd:SYSCALLexecution of realmd, samba-tool, or ldapmodify with user-related argumentsNSM:FlowTGS-REQ and AS-REQ seen for new user shortly after domain-modifying process
macOS Analytic 0008
macOS clients joined to AD via LDAP may script account provisioning via `dsconfigad`, `dscl`, or LDAP scripts. Detection occurs when such tools run on a domain-joined system, followed by authentication attempts by a previously unseen account.
macos:unifiedlogdsconfigad or dscl with create or append options for AD-bound usersmacos:unifiedlogUserLoggedIn
SigmaHQ/sigma
6 rules| Detection | Severity | Format |
|---|---|---|
| ADCS - Certighost Ghost Machine Account Creation | High | Sigma |
| PSEXEC Remote Execution File Artefact | High | Sigma |
| Suspicious Windows ANONYMOUS LOGON Local Account Created | High | Sigma |
| Manipulation of User Computer or Group Security Principals Across AD | Medium | Sigma |
| New User Account Creation Attempt Via ADSI | Medium | Sigma |
| New User Account Creation Attempt Via ADSI in CommandLine | Medium | Sigma |
splunk/security_content
5 rules| Detection | Severity | Format |
|---|---|---|
| Windows Computer Account Changed to Domain Controller | Undefined | SPL |
| Windows ESX Admins Group Creation Security Event | Undefined | SPL |
| Windows ESX Admins Group Creation via Net | Undefined | SPL |
| Windows ESX Admins Group Creation via PowerShell | Undefined | SPL |
| Windows Privileged Group Modification | Undefined | SPL |
Bert-JanP/Hunting-Queries-Detection-Rules
2 rules| Detection | Severity | Format |
|---|---|---|
| Commandline User Addition | Undefined | KQL |
| MITRE ATT&CK Mapping | Undefined | KQL |
elastic/detection-rules
2 rules| Detection | Severity | Format |
|---|---|---|
| dMSA Account Creation by an Unusual User | High | Elastic TOML |
| User Account Creation | Low | Elastic TOML |
socfortress/Wazuh-Rules
2 rules| Detection | Severity | Format |
|---|---|---|
| LDAP domain admin account creation attempt detected (ldapadd targeting admin-related LDIF) | High | Wazuh XML |
| LDAP domain user account creation attempt detected (ldapadd with any LDIF file) | Medium | Wazuh XML |