用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill t1136-001-local-account命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
基于 SOC 职业分类
正在显示 SKILL.md
| name | T1136.001_local-account |
| description | Adversaries may create a local account to maintain access to victim systems. |
| category | configuration |
| version | 18.1 |
| author | cyberstrike-official |
| tags | ["mitre-attack","enterprise","t1136.001","persistence","linux","macos","windows","network-devices","containers","esxi","sub-technique"] |
| technique_id | T1136.001 |
| tactic | persistence |
| all_tactics | ["persistence"] |
| platforms | ["Linux","macOS","Windows","Network Devices","Containers","ESXi"] |
| mitre_url | https://attack.mitre.org/techniques/T1136/001 |
| tech_stack | ["linux","macos","windows","network devices","containers","esxi"] |
| cwe_ids | ["CWE-276"] |
| chains_with | ["T1136","T1136.002","T1136.003"] |
| prerequisites | ["T1136"] |
| severity_boost | {"T1136":"Chain with T1136 for deeper attack path","T1136.002":"Chain with T1136.002 for deeper attack path","T1136.003":"Chain with T1136.003 for deeper attack path"} |
Sub-technique of: T1136
Adversaries may create a local account to maintain access to victim systems. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service.
For example, with a sufficient level of access, the Windows net user /add command can be used to create a local account. In Linux, the useradd command can be used, while on macOS systems, the dscl -create command can be used. Local accounts may also be added to network devices, often via common Network Device CLI commands such as username, to ESXi servers via esxcli system account add, or to Kubernetes clusters using the kubectl utility.
Adversaries may also create new local accounts on network firewall management consoles – for example, by exploiting a vulnerable firewall management system, threat actors may be able to establish super-admin accounts that could be used to modify firewall rules and gain further access to the network.
Such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
Platforms: Linux, macOS, Windows, Network Devices, Containers, ESXi
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
Create a user via useradd
Supported Platforms: linux Yes
useradd -M -N -r -s /bin/bash -c evil_account #{username}
Create a user via pw
Supported Platforms: linux Elevation Required: Yes
pw useradd #{username} -s /usr/sbin/nologin -d /nonexistent -c evil_account
Creates a user on a MacOS system with dscl
Supported Platforms: macos Elevation Required: Yes
dscl . -create /Users/#{username}
dscl . -create /Users/#{username} UserShell /bin/zsh
dscl . -create /Users/#{username} RealName "#{realname}"
dscl . -create /Users/#{username} UniqueID "1010"
dscl . -create /Users/#{username} PrimaryGroupID 80
dscl . -create /Users/#{username} NFSHomeDirectory /Users/#{username}
Creates a new user in a command prompt. Upon execution, "The command completed successfully." will be displayed. To verify the new account, run "net user" in powershell or CMD and observe that there is a new user named "T1136.001_CMD"
Supported Platforms: windows Elevation Required: Yes
net user /add "#{username}" "#{password}"
Creates a new user in PowerShell. Upon execution, details about the new account will be displayed in the powershell session. To verify the new account, run "net user" in powershell or CMD and observe that there is a new user named "T1136.001_PowerShell"
Supported Platforms: windows Elevation Required: Yes
New-LocalUser -Name "#{username}" -NoPassword
If Atomic Red Team tests are not applicable, manually verify the technique by:
Identify Attack Surface: Determine if the target environment is susceptible to Local Account by examining the target platforms (Linux, macOS, Windows).
Assess Existing Defenses: Review whether mitigations for T1136.001 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Use multi-factor authentication for user and privileged accounts.
Limit the number of accounts permitted to create other accounts. Limit the usage of local administrator accounts to be used for day-to-day operations that may expose them to potential adversaries.
| Finding | Severity | Impact |
|---|---|---|
| Local Account technique applicable | High | Persistence |
| CWE ID | Title |
|---|---|
| CWE-276 | Incorrect Default Permissions |