t1136-create-account

name	T1136_create-account
description	Adversaries may create an account to maintain access to victim systems.
category	configuration
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1136","persistence","windows","iaas","linux","macos","network-devices","containers","saas","office-suite","identity-provider","esxi"]
technique_id	T1136
tactic	persistence
all_tactics	["persistence"]
platforms	["Windows","IaaS","Linux","macOS","Network Devices","Containers","SaaS","Office Suite","Identity Provider","ESXi"]
mitre_url	https://attack.mitre.org/techniques/T1136
tech_stack	["windows","cloud","linux","macos","network devices","containers","saas","office","identity","esxi"]
cwe_ids	["CWE-276"]
chains_with	["T1136.001","T1136.002","T1136.003"]
prerequisites	[]
severity_boost	{"T1136.001":"Chain with T1136.001 for deeper attack path","T1136.002":"Chain with T1136.002 for deeper attack path","T1136.003":"Chain with T1136.003 for deeper attack path"}

T1136 Create Account

High-Level Description

Adversaries may create an account to maintain access to victim systems. With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.

Accounts may be created on the local system or within a domain or cloud tenant. In cloud environments, adversaries may create accounts that only have access to specific services, which can reduce the chance of detection.

Kill Chain Phase

• Persistence (TA0003)

Platforms: Windows, IaaS, Linux, macOS, Network Devices, Containers, SaaS, Office Suite, Identity Provider, ESXi

What to Check

• Identify if Create Account technique is applicable to target environment
• Check Windows systems for indicators of Create Account
• Check IaaS systems for indicators of Create Account
• Check Linux systems for indicators of Create Account
• Verify mitigations are bypassed or absent (4 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Manual Testing

1. Identify Attack Surface: Determine if the target environment is susceptible to Create Account by examining the target platforms (Windows, IaaS, Linux).

2. Assess Existing Defenses: Review whether mitigations for T1136 are in place. If defenses are absent or misconfigured, this technique may be exploitable.

3. Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.

Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.

Remediation Guide

M1030 Network Segmentation

Configure access controls and firewalls to limit access to domain controllers and systems used to create and manage accounts.

M1028 Operating System Configuration

Protect domain controllers by ensuring proper security configuration for critical servers.

M1032 Multi-factor Authentication