Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1136_create-account
Adversaries may create an account to maintain access to victim systems.
Passed 22 of 23 test cases with the skill, and 16 of 23 without it.
and 5 more in the full report
6 fixed16 passed either way1 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 6 test cases the skill fixed. Same model, same prompt, with and without the skill.
In our SOC capability matrix for T1136 Create Account, how many distinct detection strategies are specified for assessing cross-platform detection coverage?
| Checked | Without skill | With skill |
|---|---|---|
| Specifies 1 detection strategy for T1136. | Missed | Passed |
The instructions your model reads when the skill loads.
Adversaries may create an account to maintain access to victim systems. With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
Accounts may be created on the local system or within a domain or cloud tenant. In cloud environments, adversaries may create accounts that only have access to specific services, which can reduce the chance of detection.
Platforms: Windows, IaaS, Linux, macOS, Network Devices, Containers, SaaS, Office Suite, Identity Provider, ESXi
Identify Attack Surface: Determine if the target environment is susceptible to Create Account by examining the target platforms (Windows, IaaS, Linux).
Assess Existing Defenses: Review whether mitigations for T1136 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.
Configure access controls and firewalls to limit access to domain controllers and systems used to create and manage accounts.
test cases passed, vs 16 / 23 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.