Create Account `T1136`

Tactic: Persistence

Adversaries may create an account to maintain access to victim systems. With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.

Events covered

33 catalog events are tagged with this technique by at least one rule.

Provider	Event	Title
Sysmon	Event ID 1	Process creation
Sysmon	Event ID 11	FileCreate
Sysmon	Event ID 12	RegistryEvent (Object create and delete)
Sysmon	Event ID 13	RegistryEvent (Value Set)
Sysmon	Event ID 14	RegistryEvent (Key and Value Rename)
Security-Auditing	Event ID 4688	A new process has been created.
Security-Auditing	Event ID 4720	A user account was created.
Security-Auditing	Event ID 4723	An attempt was made to change an account's password.
Security-Auditing	Event ID 4726	A user account was deleted.
Security-Auditing	Event ID 4727	A security-enabled global group was created.
Security-Auditing	Event ID 4730	A security-enabled global group was deleted.
Security-Auditing	Event ID 4731	A security-enabled local group was created.
Security-Auditing	Event ID 4732	A member was added to a security-enabled local group.
Security-Auditing	Event ID 4737	A security-enabled global group was changed.
Security-Auditing	Event ID 4741	A computer account was created.
Security-Auditing	Event ID 4742	A computer account was changed.
Security-Auditing	Event ID 4744	A security-disabled local group was created.
Security-Auditing	Event ID 4749	A security-disabled global group was created.
Security-Auditing	Event ID 4754	A security-enabled universal group was created.
Security-Auditing	Event ID 4756	A member was added to a security-enabled universal group.
Security-Auditing	Event ID 4759	A security-disabled universal group was created.
Security-Auditing	Event ID 4781	The name of an account was changed.
Security-Auditing	Event ID 4783	A basic application group was created.
Security-Auditing	Event ID 4790	An LDAP query group was created.
Security-Auditing	Event ID 5137	A directory service object was created.
Defender-DeviceProcessEvents	any	Process activity (any)
ESF	exec	Process Execution (Notify)
Linux-Auditd	Event ID 1114	ADD_USER
Linux-Auditd	Event ID 1300	SYSCALL
MSSQLSERVER	Event ID 33205	Event ID 33205
PowerShell	Event ID 4103	Payload Context: ContextInfo User Data: UserData.
PowerShell	Event ID 4104	Creating Scriptblock text (MessageNumber of MessageTotal).
Sysmon-for-Linux	Event ID 1	Process Create

Authoring guide

Patterns shared across the 165 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (152 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

Field	Rules	How	Sample values
`CommandLine`	23	`contains` 16, `in` 4, `match` 3, `regex_match` 3, `ends_with` 1	`add`, `user`, `(?i)(\-u)\|(user)\|(localgroup)\|(group)`, `(?i).add`, `(?i)searchroot\|objectcategory=\|userenum`
`sourcetype`	23	`eq` 22, `in` 1	`o365:management:activity`, `azure:monitor:aad`, `aws:cloudtrail`, `auditd`, `aws:asl`
`EventID`	16	`eq` 14, `in` 2	`4688`, `4104`, `1`, `4720`, `4727`
`EventType`	16	`eq` 10, `in` 5, `wildcard` 1	`exec`, `AddRoleToInstanceProfile`, `ProcessRollup2`, `exec_event`, `AddUserToGroup`
`OperationName`	12	`contains` 7, `eq` 3, `in` 2	`update a partner cross-tenant access setting`, `Add user`, `Add User`, `Add member to group`, `Add owner to group`
`type`	11	`eq` 11	`Policy`, `ADD_USER`, `User`, `SYSCALL`, `ServicePrincipal`
`Image`	10	`ends_with` 8, `eq` 1, `is_not_null` 1, `regex_match` 1	`\net.exe`, `\net1.exe`, `/dscl`, `/esxcli`, `/sysadminctl`
`aws::eventName`	10	`eq` 9, `in` 1	`CreateAccessKey`, `CreateUser`, `UpdateLoginProfile`, `Add-FederatedDomain`, `BatchCreateUser`
`data_stream.dataset`	10	`eq` 10	`aws.cloudtrail`, `azure.auditlogs`, `github.audit`, `fim.event`, `gcp.audit`
`event.outcome`	10	`eq` 8, `in` 2	`success`, `Success`
`event.type`	10	`eq` 7, `in` 3	`start`, `creation`, `change`, `group`, `process_started`
`host.os.type`	9	`eq` 9
`process_name`	9	`eq` 7, `in` 2, `is_not_null` 1	`net1.exe`, `adduser`, `openssl`, `dscl`, `gpasswd`
`Operation`	8	`eq` 5, `contains` 2, `in` 1, `starts_with` 1	`Add service principal.`, `add`, `new`, `Add app role assignment grant to user.`, `SharingPolicyChanged`
`TargetUserName`	7	`eq` 4, `ends_with` 3, `contains` 1, `in` 1	`$`, `Administrators`, `Account Operators`, `Admins DNS`, `ESX Admins`

Top indicator values (633 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.

Field	Kind	Value	Rules (here)	Corpus reach
`event.outcome`	`eq`	`success` elasticAWS IAM Create User via Assumed Role on EC2 Instance elasticAWS IAM Group Creation elasticAWS IAM Sensitive Operations via Lambda Execution Role elasticAWS Sensitive IAM Operations Performed via CloudShell elasticGCP Service Account Creation elasticLinux Group Creation elasticLinux User Account Creation elasticSuspicious Passwd File Event Action	8	251
`sourcetype`	`eq`	`o365:management:activity` splunkO365 Add App Role Assignment Grant User splunkO365 Added Service Principal splunkO365 External Guest User Invited splunkO365 External Identity Policy Changed splunkO365 Multiple Service Principals Created by SP splunkO365 Multiple Service Principals Created by User splunkO365 New Federated Domain Added splunkO365 SharePoint Allowed Domains Policy Changed	8	80
`sourcetype`	`eq`	`azure:monitor:aad` splunkAzure AD External Guest User Invited splunkAzure AD Multiple Service Principals Created by SP splunkAzure AD Multiple Service Principals Created by User splunkAzure AD Service Principal Created	4	47
`sourcetype`	`eq`	`aws:cloudtrail` splunkAWS CreateAccessKey splunkAWS CreateLoginProfile splunkAWS UpdateLoginProfile	3	59
`Workload`	`eq`	`AzureActiveDirectory` splunkO365 Add App Role Assignment Grant User splunkO365 Added Service Principal splunkO365 External Guest User Invited splunkO365 External Identity Policy Changed splunkO365 Multiple Service Principals Created by SP splunkO365 Multiple Service Principals Created by User	6	31
`type`	`eq`	`Policy` kustoCross-tenant Access Settings Organization Added kustoCross-tenant Access Settings Organization Deleted kustoCross-tenant Access Settings Organization Inbound Collaboration Settings Changed kustoCross-tenant Access Settings Organization Inbound Direct Settings Changed kustoCross-tenant Access Settings Organization Outbound Collaboration Settings Changed kustoCross-tenant Access Settings Organization Outbound Direct Settings Changed	6	6
`CommandLine`	`contains`	`add` sigmaDarkGate - User Created Via Net.EXE sigmaNew User Created Via Net.EXE sigmaNew User Created Via Net.EXE With Never Expire Option sigmaUser creation via commandline chronicleNew User Created Via Net.EXE	5	34
`CommandLine`	`contains`	`user` sigmaDarkGate - User Created Via Net.EXE sigmaNew User Created Via Net.EXE sigmaNew User Created Via Net.EXE With Never Expire Option sigmaUser creation via commandline chronicleNew User Created Via Net.EXE	5	17
`CommandLine`	`contains`	`/add` splunkWindows Create Local Administrator Account Via Net splunkWindows ESX Admins Group Creation via Net	2	9
`Image`	`ends_with`	`\net.exe` sigmaDarkGate - User Created Via Net.EXE sigmaNew User Created Via Net.EXE sigmaNew User Created Via Net.EXE With Never Expire Option sigmaUser creation via commandline sigmaUser enumeration and creation related to Manic Menagerie 2.0 (via cmdline)	5	49
`Image`	`ends_with`	`\net1.exe` sigmaDarkGate - User Created Via Net.EXE sigmaNew User Created Via Net.EXE sigmaNew User Created Via Net.EXE With Never Expire Option sigmaUser creation via commandline sigmaUser enumeration and creation related to Manic Menagerie 2.0 (via cmdline)	5	47
`EventID`	`eq`	`4688` splunkCreate_Add Local_Domain User (Windows Event Log) splunkUser_Domain Enumeration Tool - Windows (Windows Event Log) kustoPowershell Empire Cmdlets Executed in Command Line kustoUnusual identity creation using exchange powershell	4	313
`EventID`	`eq`	`4104` splunkUser_Domain Enumeration Tool - Windows (PowerShell) splunkWindows Azure PowerShell Module Installation Via PowerShell Script splunkWindows ESX Admins Group Creation via PowerShell	3	268
`EventID`	`eq`	`1` splunkCreate_Add Local_Domain User (Sysmon) splunkUser_Domain Enumeration Tool - Windows (Sysmon)	2	237
`EventID`	`eq`	`4720` splunkCreate_Add Local_Domain User (Windows Event Log) splunkDetect New Local Admin account	2	5
`OperationName`	`contains`	`update a partner cross-tenant access setting` kustoCross-tenant Access Settings Organization Inbound Collaboration Settings Changed kustoCross-tenant Access Settings Organization Inbound Direct Settings Changed kustoCross-tenant Access Settings Organization Outbound Collaboration Settings Changed kustoCross-tenant Access Settings Organization Outbound Direct Settings Changed	4	4
`OriginalFileName`	`eq`	`net1.exe` sigmaNew User Created Via Net.EXE sigmaNew User Created Via Net.EXE With Never Expire Option splunkWindows Create Local Administrator Account Via Net splunkWindows ESX Admins Group Creation via Net	4	44
`Provider_Name`	`eq`	`iam.amazonaws.com` elasticAWS IAM Create User via Assumed Role on EC2 Instance elasticAWS IAM Group Creation elasticAWS IAM Sensitive Operations via Lambda Execution Role elasticAWS Sensitive IAM Operations Performed via CloudShell	4	25
`event.type`	`eq`	`start` elasticLinux User Added to Privileged Group elasticOpenSSL Password Hash Generation elasticSuspicious Passwd File Event Action elasticUser Account Creation	4	606
`unique_apps`	`gt`	`3` splunkAzure AD Multiple Service Principals Created by SP splunkAzure AD Multiple Service Principals Created by User splunkO365 Multiple Service Principals Created by SP splunkO365 Multiple Service Principals Created by User	4	4
`CommandLine`	`match`	`(?i)(\-u)\|(user)\|(localgroup)\|(group)` splunkCreate_Add Local_Domain User (EDR) splunkCreate_Add Local_Domain User (Sysmon) splunkCreate_Add Local_Domain User (Windows Event Log)	3	3
`CommandLine`	`match`	`(?i).add` splunkCreate_Add Local_Domain User (EDR) splunkCreate_Add Local_Domain User (Sysmon) splunkCreate_Add Local_Domain User (Windows Event Log)	3	3
`CommandLine`	`regex_match`	`(?i)searchroot\|objectcategory=\|userenum` splunkUser_Domain Enumeration Tool - Windows (PowerShell) splunkUser_Domain Enumeration Tool - Windows (Sysmon) splunkUser_Domain Enumeration Tool - Windows (Windows Event Log)	3	3
`TargetUserName`	`ends_with`	`$` sigmaHidden Local User Creation sigmaSuspicious computer account created by a computer account sigmaUser account creation disguised in a computer account	3	7
`data_stream.dataset`	`eq`	`aws.cloudtrail` elasticAWS IAM Create User via Assumed Role on EC2 Instance elasticAWS IAM Group Creation elasticAWS Sensitive IAM Operations Performed via CloudShell	3	141
`operationName`	`eq`	`Add service principal` splunkAzure AD Multiple Service Principals Created by SP splunkAzure AD Multiple Service Principals Created by User splunkAzure AD Service Principal Created	3	3
`process_name`	`eq`	`net1.exe` elasticUser Account Creation splunkWindows Create Local Administrator Account Via Net splunkWindows ESX Admins Group Creation via Net	3	35
`security_result.action`	`eq`	`ALLOW` chronicleAWS Privilege Escalation Using IAM Access Key chronicleAWS Privilege Escalation Using IAM Login Profile chronicleGCP Free Gmail Domains Added To IAM Policy	3	102
`All_Changes.result_id`	`eq`	`4720` splunkShort Lived Windows Accounts splunkWindows Create Local Account	2	2
`EXECUTION_STATUS`	`eq`	`SUCCESS` pantherSnowflake User Created pantherSnowflake User Enabled	2	5

Exclusions (68 distinct)

Field/operator/value combinations excluded by rules under this technique (top-level not() clauses), sorted by how many rules exclude each. These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths. Click a value to expand the rules under this technique that exclude it.

Field	Kind	Value	Rules excluding
`SubjectUserName`	`eq`	`%sap_admin_users.user` chroniclesap security audit log user created deleted or unlocked chroniclesap user creates and uses new user	2
`actionName`	`in`	`removeAdmin` pantherDatabricks Account Admin Privileged Role Assignment pantherDatabricks Workspace Admin Privileged Role Assignment	2
`actionName`	`in`	`removePrincipalFromGroup` pantherDatabricks Account Admin Privileged Role Assignment pantherDatabricks Workspace Admin Privileged Role Assignment	2
`parent_process_name`	`eq`	`net.exe` elasticUser Account Creation kustoAccount Creation	2
`AADGroupId`	`in`	`Custom AAD GROUP OBJECT ID 2` kustoGuest accounts added in Entra ID Groups other than the ones specified	1
`AADGroupId`	`in`	`List with Custom AAD GROUP OBJECT ID 1` kustoGuest accounts added in Entra ID Groups other than the ones specified	1
`Computer`	`eq`	`%domain_controllers%` sigmaHidden account creation (with fast deletion)	1
`DstUserName`	`eq`	`known_usrs` kustoPing Federate - New user SSO success login	1
`EventData`	`contains`	`gc_service.exe` kustoPowershell Empire Cmdlets Executed in Command Line	1
`EventData`	`contains`	`gc_worker.exe` kustoPowershell Empire Cmdlets Executed in Command Line	1
`ExtTenantIDAdded`	`in`	`List of expected tenant IDs` kustoCross-tenant Access Settings Organization Added	1
`ExtTenantIDAdded`	`in`	`Tenant ID 2` kustoCross-tenant Access Settings Organization Added	1
`Image`	`in`	`./usr/bin/qemu-aarch64-static` elasticShadow File Modification by Unusual Process	1
`Image`	`in`	`/bin/dnf` elasticShadow File Modification by Unusual Process	1
`Image`	`in`	`/usr/bin/containerd` elasticShadow File Modification by Unusual Process	1

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)

Create Account `T1136`

Events covered

Authoring guide

Fields filtered most (152 distinct)

Top indicator values (633 distinct)

Exclusions (68 distinct)

Rules under this technique

Sigma 38 rules

Elastic 24 rules

Splunk 45 rules

Kusto 22 rules

YARA-L 7 rules

Panther 29 rules

Keyboard shortcuts

Search operators

Create Account T1136

Events covered

Authoring guide

Fields filtered most (152 distinct)

Top indicator values (633 distinct)

Exclusions (68 distinct)

Rules under this technique

Sigma 38 rules

Elastic 24 rules

Splunk 45 rules

Kusto 22 rules

YARA-L 7 rules

Panther 29 rules

Create Account `T1136`