Cross-source coverage
T1136 / ATT&CK
Create Account
174 rules across 9 sources.
Showing deprecated rules · back to the default
From MITRE ATT&CK 19.2
Adversaries may create an account to maintain access to victim systems. With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
Accounts may be created on the local system or within a domain or cloud tenant. In cloud environments, adversaries may create accounts that only have access to specific services, which can reduce the chance of detection.
- Tactics
- Persistence
- Platforms
- Windows · IaaS · Linux · macOS · Network Devices · Containers · SaaS · Office Suite · Identity Provider · ESXi
- Telemetry
-
WinEventLog:SecurityWinEventLog:Sysmonauditd:SYSCALLmacos:unifiedlogazure:auditAWS:CloudTrail
How MITRE says to detect it DET0583
Detection Strategy for T1136 - Create Account across platforms
Windows Analytic 1604
Adversary uses built-in OS tools or API calls to create local or domain accounts for persistence or lateral movement. Tools such as 'net user', PowerShell, or MMC snap-ins may be used. Detection focuses on Event ID 4720 paired with process lineage and user context.
WinEventLog:SecurityEventCode=4720WinEventLog:SysmonEventCode=1
Linux Analytic 1605
Adversary invokes 'useradd', 'adduser', or equivalent system commands or scripts to create local users. Detection focuses on command execution and audit trail of passwd/shadow file modifications.
auditd:SYSCALLuseradd or adduser executedauditd:SYSCALLchmod/chown to /etc/passwd or /etc/shadow
macOS Analytic 1606
Adversary creates new users using 'dscl' commands, GUI tools, or by modifying user plist files. Detection includes monitoring dscl invocation and user-related plist changes.
macos:unifiedlogdscl . -createmacos:unifiedlogmodification to /var/db/dslocal/nodes/Default/users/
Identity Provider Analytic 1607
Adversary creates users via IAM/IdP API or portal (e.g., Azure AD, Okta). Detection involves monitoring API calls, admin action logs, and correlation with role assignments.
azure:auditAdd user
IaaS Analytic 1608
Account creation via cloud service APIs or CLI, often associated with key generation. Monitored via CloudTrail or equivalent audit logs.
AWS:CloudTrailCreateUserAWS:CloudTrailAttachUserPolicy
Sub-techniques with coverage
Counted in the 174 above — a rule tagged a sub-technique covers this technique too.
splunk/security_content
39 rules| Detection | Severity | Format |
|---|---|---|
| ASL AWS Create Access Key | Undefined | SPL |
| ASL AWS UpdateLoginProfile | Undefined | SPL |
| AWS CreateAccessKey | Undefined | SPL |
| AWS CreateLoginProfile | Undefined | SPL |
| AWS UpdateLoginProfile | Undefined | SPL |
| Azure AD External Guest User Invited | Undefined | SPL |
| Azure AD Multiple Service Principals Created by SP | Undefined | SPL |
| Azure AD Multiple Service Principals Created by User | Undefined | SPL |
| Azure AD Service Principal Created | Undefined | SPL |
| Azure Automation Account Created | Undefined | SPL |
+ 29 more from splunk/security_content → showing the 10 highest-severity
elastic/detection-rules
28 rules| Detection | Severity | Format |
|---|---|---|
| AWS IAM Create User via Assumed Role on EC2 Instance | High | Elastic TOML |
| AWS IAM Sensitive Operations via Lambda Execution Role | High | Elastic TOML |
| AWS Sensitive IAM Operations Performed via CloudShell | High | Elastic TOML |
| Creation of a Hidden Local User Account | High | Elastic TOML |
| dMSA Account Creation by an Unusual User | High | Elastic TOML |
| FortiGate SSO Login Followed by Administrator Account Creation | High | Elastic TOML |
| Potential Linux Backdoor User Account Creation | High | Elastic TOML |
| Attempt to Create Okta API Token | Medium | Elastic TOML |
| FortiGate Administrator Account Creation from Unusual Source | Medium | Elastic TOML |
| FortiGate Super Admin Account Creation | Medium | Elastic TOML |
+ 18 more from elastic/detection-rules → showing the 10 highest-severity
panther-labs/panther-analysis
27 rules| Detection | Severity | Format |
|---|---|---|
| Auth0 Fraud Risk by Volume | High | Panther Python |
| Auth0 New Admin Invited WITH Tenant Member Account Deletion | High | Panther Python |
| Auth0 Rapid Dynamic Client Creation | High | Panther Python |
| Carbon Black User Added Outside Org | High | Panther Python |
| Crowdstrike Ephemeral User Account | High | Panther Python |
| Crowdstrike New Admin User Created | High | Panther Python |
| GCP Inbound SSO Profile Created | High | Panther Python |
| GCP Workforce Pool Created or Updated | High | Panther Python |
| GCP Workload Identity Pool Created or Updated | High | Panther Python |
| Teleport Create User Accounts | High | Panther Python |
+ 17 more from panther-labs/panther-analysis → showing the 10 highest-severity
SigmaHQ/sigma
26 rules| Detection | Severity | Format |
|---|---|---|
| Serv-U Exploitation CVE-2021-35211 by DEV-0322 | Critical | Sigma |
| ADCS - Certighost Ghost Machine Account Creation | High | Sigma |
| Cisco Local Accounts | High | Sigma |
| Creation of a Local Hidden User Account by Registry | High | Sigma |
| DarkGate - User Created Via Net.EXE | High | Sigma |
| Hidden Local User Creation | High | Sigma |
| New User Created Via Net.EXE With Never Expire Option | High | Sigma |
| Privileged User Has Been Created | High | Sigma |
| PSEXEC Remote Execution File Artefact | High | Sigma |
| Suspicious Windows ANONYMOUS LOGON Local Account Created | High | Sigma |
+ 16 more from SigmaHQ/sigma → showing the 10 highest-severity
socfortress/Wazuh-Rules
20 rules+ 10 more from socfortress/Wazuh-Rules → showing the 10 highest-severity
Azure/Azure-Sentinel
11 rules| Detection | Severity | Format |
|---|---|---|
| Unusual identity creation using exchange powershell | High | KQL |
| Account created from non-approved sources | Medium | KQL |
| Anomalous login followed by Teams action | Medium | KQL |
| User Account Created Using Incorrect Naming Format | Low | KQL |
| User account created without expected attributes defined | Low | KQL |
| Consent to Application discovery | Undefined | KQL |
| GitHub First Time Invite Member and Add Member to Repo | Undefined | KQL |
| GitHub Inactive or New Account Access or Usage | Undefined | KQL |
| Privileged role assigned to newly created account | Undefined | KQL |
| Rare Audit activity initiated by App | Undefined | KQL |
+ 1 more from Azure/Azure-Sentinel → showing the 10 highest-severity
Wazuh Core Ruleset
10 rules| Detection | Severity | Format |
|---|---|---|
| of an user. | Critical | Wazuh XML |
| executed a user creation command · win.eventdata.commandLine = (?i)add\s | High | Wazuh XML |
| New user added to the system. | Medium | Wazuh XML |
| Office 365: Blocked sharing invitation | Medium | Wazuh XML |
| Auditd: User-space account addition ended abnormally. | Low | Wazuh XML |
| Computer account added/changed/deleted | Low | Wazuh XML |
| GCP new service account created. | Low | Wazuh XML |
| User added to group. | Low | Wazuh XML |
| User added to group sudo. | Low | Wazuh XML |
| Windows: Computer account added/changed/deleted. | Low | Wazuh XML |
chronicle/detection-rules
8 rules| Detection | Severity | Format |
|---|---|---|
| sap_user_creates_and_uses_new_user | Critical | YARA-L |
| gcp_free_gmail_domains_added_to_iam_policy | High | YARA-L |
| new_user_created_via_net_exe | Medium | YARA-L |
| sap_hanadb_user_admin_actions | Medium | YARA-L |
| sap_security_audit_log_user_created_deleted_or_unlocked | Medium | YARA-L |
| aws_privilege_escalation_using_iam_access_key | Low | YARA-L |
| aws_privilege_escalation_using_iam_login_profile | Low | YARA-L |
| detects_local_user_creation | Undefined | YARA-L |
Bert-JanP/Hunting-Queries-Detection-Rules
5 rules| Detection | Severity | Format |
|---|---|---|
| Cloud Persistence Activities by User At Risk | Undefined | KQL |
| Commandline User Addition | Undefined | KQL |
| Local Account Created | Undefined | KQL |
| Local Administrator Additions | Undefined | KQL |
| MITRE ATT&CK Mapping | Undefined | KQL |