T1136 Create Account

High-Level Description

Adversaries may create an account to maintain access to victim systems. With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.

Accounts may be created on the local system or within a domain or cloud tenant. In cloud environments, adversaries may create accounts that only have access to specific services, which can reduce the chance of detection.

Kill Chain Phase

• Persistence (TA0003)

Platforms: Windows, IaaS, Linux, macOS, Network Devices, Containers, SaaS, Office Suite, Identity Provider, ESXi

What to Check

• ] Identify if Create Account technique is applicable to target environment
• ] Check Windows systems for indicators of Create Account
• ] Check IaaS systems for indicators of Create Account
• ] Check Linux systems for indicators of Create Account
• ] Verify mitigations are bypassed or absent (4 known mitigations)
• ] Assess detection coverage (1 detection strategies)

How to Test

Manual Testing

1. Identify Attack Surface: Determine if the target environment is susceptible to Create Account by examining the target platforms (Windows, IaaS, Linux).

1. Assess Existing Defenses: Review whether mitigations for T1136 are in place. If defenses are absent or misconfigured, this technique may be exploitable.

1. Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.

> Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.

Remediation Guide

M1030 Network Segmentation

Configure access controls and firewalls to limit access to domain controllers and systems used to create and manage accounts.

M1028 Operating System Configuration

Protect domain controllers by ensuring proper security configuration for critical servers.

M1032 Multi-factor Authentication

Use multi-factor authentication for user and privileged accounts.

M1026 Privileged Account Management

Limit the number of accounts with permissions to create other accounts. Do not allow domain administrator accounts to be used for day-to-day operations that may expose them to potential adversaries on unprivileged systems.

Detection

Detection Strategy for T1136 - Create Account across platforms

Risk Assessment

| Finding | Severity | Impact | | ----------------------------------- | -------- | ----------- | | Create Account technique applicable | High | Persistence |

CWE Categories

| CWE ID | Title | | ------- | ----------------------------- | | CWE-276 | Incorrect Default Permissions |

References

• Microsoft User Creation Event
• Symantec WastedLocker June 2020
• Atomic Red Team - T1136
• MITRE ATT&CK - T1136