Create Account `T1136`

Tactic: Persistence

Adversaries may create an account to maintain access to victim systems. With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.

Events covered

36 catalog events are tagged with this technique by at least one rule.

Provider	Event	Title
Sysmon	Event ID 1	Process creation
Sysmon	Event ID 11	FileCreate
Sysmon	Event ID 12	RegistryEvent (Object create and delete)
Sysmon	Event ID 13	RegistryEvent (Value Set)
Sysmon	Event ID 14	RegistryEvent (Key and Value Rename)
Security-Auditing	Event ID 4688	A new process has been created.
Security-Auditing	Event ID 4720	A user account was created.
Security-Auditing	Event ID 4726	A user account was deleted.
Security-Auditing	Event ID 4727	A security-enabled global group was created.
Security-Auditing	Event ID 4730	A security-enabled global group was deleted.
Security-Auditing	Event ID 4731	A security-enabled local group was created.
Security-Auditing	Event ID 4732	A member was added to a security-enabled local group.
Security-Auditing	Event ID 4737	A security-enabled global group was changed.
Security-Auditing	Event ID 4741	A computer account was created.
Security-Auditing	Event ID 4742	A computer account was changed.
Security-Auditing	Event ID 4744	A security-disabled local group was created.
Security-Auditing	Event ID 4749	A security-disabled global group was created.
Security-Auditing	Event ID 4754	A security-enabled universal group was created.
Security-Auditing	Event ID 4756	A member was added to a security-enabled universal group.
Security-Auditing	Event ID 4759	A security-disabled universal group was created.
Security-Auditing	Event ID 4781	The name of an account was changed.
Security-Auditing	Event ID 4783	A basic application group was created.
Security-Auditing	Event ID 4790	An LDAP query group was created.
Security-Auditing	Event ID 5137	A directory service object was created.
1Password-Invite	invite-create	Create Invite
1Password-ServiceAccount	sa-create	Create Integration
1Password-Vault	vault-export	Export Vault
Defender-DeviceProcessEvents	any	Process activity
ESF	exec	Process Execution
Linux-Auditd	Event ID 1114	ADD_USER
Linux-Auditd	Event ID 1300	SYSCALL
Linux-Auditd	Event ID 1327	PROCTITLE
MSSQLSERVER	Event ID 33205	Event ID 33205
PowerShell	Event ID 4103	Payload Context: ContextInfo User Data: UserData.
PowerShell	Event ID 4104	Creating Scriptblock text (MessageNumber of MessageTotal).
Sysmon-for-Linux	Event ID 1	Process Create

Authoring guide

These 174 rules share fields, values, and exclusions.

Fields filtered most (133 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`CommandLine`	24	`contains` 17, `regex_match` 5, `in` 4, `eq` 1, `match` 1	`add`, `user`, `(?i)searchroot\|objectcategory=\|userenum`, `(?i)(\-u)\|(user)\|(localgroup)\|(group)`, `(?i).add`
`sourcetype`	23	`eq` 22, `in` 1	`o365:management:activity`, `azure:monitor:aad`, `aws:cloudtrail`, `auditd`, `aws:asl`
`EventType`	18	`eq` 11, `in` 6, `wildcard` 1	`exec`, `ProcessRollup2`, `exec_event`, `AddRoleToInstanceProfile`, `AddUserToGroup`
`EventID`	16	`eq` 14, `in` 2	`4688`, `4104`, `1`, `4720`, `4727`
`OperationName`	12	`contains` 7, `eq` 3, `in` 2	`Update a partner cross-tenant access setting`, `Add user`, `Add User`, `Add a partner to cross-tenant access setting`, `Add member to group`
`Image`	11	`ends_with` 9, `eq` 1, `is_not_null` 1, `regex_match` 1	`\net.exe`, `\net1.exe`, , `/dscl`, `/esxcli`
`event.type`	11	`eq` 8, `in` 3	`start`, `creation`, `change`, `group`, `process_started`
`process_basename`	11	`eq` 8, `in` 3, `is_not_null` 1	`net1.exe`, `adduser`, `net.exe`, `openssl`, `usermod`
`Operation`	10	`eq` 6, `contains` 2, `in` 2, `starts_with` 1	`Add service principal.`, `MemberAdded`, `Add service principal`, `add`, `domain`
`aws::eventName`	10	`eq` 9, `in` 1	`CreateAccessKey`, `CreateUser`, `UpdateLoginProfile`, `Add-FederatedDomain`, `BatchCreateUser`
`data_stream.dataset`	10	`eq` 10	`aws.cloudtrail`, `azure.auditlogs`, `github.audit`, `fim.event`, `gcp.audit`
`event.outcome`	10	`eq` 10	`success`, `Success`
`action`	9	`eq` 8, `in` 1	`Add`, `create`, `CreateUser`, `DeleteUser`, `created`
`TargetUserName`	8	`ends_with` 4, `eq` 4, `contains` 1, `in` 1, `starts_with` 1	`$`, `Administrators`, `ESX Admins`, `Account Operators`, `Admins DNS`
`Workload`	7	`eq` 7	`AzureActiveDirectory`, `SharePoint`

Top indicator values (644 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`sourcetype`	`eq`	`o365:management:activity` splunkO365 Add App Role Assignment Grant User splunkO365 Added Service Principal splunkO365 External Guest User Invited splunkO365 External Identity Policy Changed splunkO365 Multiple Service Principals Created by SP splunkO365 Multiple Service Principals Created by User splunkO365 New Federated Domain Added splunkO365 SharePoint Allowed Domains Policy Changed	8	80
`sourcetype`	`eq`	`azure:monitor:aad` splunkAzure AD External Guest User Invited splunkAzure AD Multiple Service Principals Created by SP splunkAzure AD Multiple Service Principals Created by User splunkAzure AD Service Principal Created	4	47
`sourcetype`	`eq`	`aws:cloudtrail` splunkAWS CreateAccessKey splunkAWS CreateLoginProfile splunkAWS UpdateLoginProfile	3	59
`event.outcome`	`eq`	`Success` elasticAWS IAM Create User via Assumed Role on EC2 Instance elasticAWS IAM Group Creation elasticAWS IAM Sensitive Operations via Lambda Execution Role elasticAWS Sensitive IAM Operations Performed via CloudShell elasticEntra ID External Guest User Invited elasticEntra ID Service Principal Created elasticGCP Service Account Creation	7	306
`event.outcome`	`eq`	`success` elasticLinux Group Creation elasticLinux User Account Creation elasticSuspicious Passwd File Event Action	3	82
`Workload`	`eq`	`AzureActiveDirectory` splunkO365 Add App Role Assignment Grant User splunkO365 Added Service Principal splunkO365 External Guest User Invited splunkO365 External Identity Policy Changed splunkO365 Multiple Service Principals Created by SP splunkO365 Multiple Service Principals Created by User	6	30
`Image`	`ends_with`	`\net.exe` sigmaDarkGate - User Created Via Net.EXE sigmaNew User Created Via Net.EXE sigmaNew User Created Via Net.EXE With Never Expire Option sigmaUser creation via commandline sigmaUser enumeration and creation related to Manic Menagerie 2.0 (via cmdline)	5	49
`Image`	`ends_with`	`\net1.exe` sigmaDarkGate - User Created Via Net.EXE sigmaNew User Created Via Net.EXE sigmaNew User Created Via Net.EXE With Never Expire Option sigmaUser creation via commandline sigmaUser enumeration and creation related to Manic Menagerie 2.0 (via cmdline)	5	47
`event.type`	`eq`	`start` elasticLinux User Added to Privileged Group elasticOpenSSL Password Hash Generation elasticPotential Linux Backdoor User Account Creation elasticSuspicious Passwd File Event Action elasticUser Account Creation	5	1036
`CommandLine`	`contains`	`add` sigmaDarkGate - User Created Via Net.EXE sigmaNew User Created Via Net.EXE sigmaNew User Created Via Net.EXE With Never Expire Option sigmaUser creation via commandline	4	30
`CommandLine`	`contains`	`user` sigmaDarkGate - User Created Via Net.EXE sigmaNew User Created Via Net.EXE sigmaNew User Created Via Net.EXE With Never Expire Option sigmaUser creation via commandline	4	15
`OperationName`	`contains`	`Update a partner cross-tenant access setting` kustoCross-tenant Access Settings Organization Inbound Collaboration Settings Changed kustoCross-tenant Access Settings Organization Inbound Direct Settings Changed kustoCross-tenant Access Settings Organization Outbound Collaboration Settings Changed kustoCross-tenant Access Settings Organization Outbound Direct Settings Changed	4	4
`OriginalFileName`	`eq`	`net1.exe` sigmaNew User Created Via Net.EXE sigmaNew User Created Via Net.EXE With Never Expire Option splunkWindows Create Local Administrator Account Via Net splunkWindows ESX Admins Group Creation via Net	4	39
`Provider_Name`	`eq`	`iam.amazonaws.com` elasticAWS IAM Create User via Assumed Role on EC2 Instance elasticAWS IAM Group Creation elasticAWS IAM Sensitive Operations via Lambda Execution Role elasticAWS Sensitive IAM Operations Performed via CloudShell	4	24
`TargetUserName`	`ends_with`	`$` sigmaADCS - Certighost Ghost Machine Account Creation sigmaHidden Local User Creation sigmaSuspicious computer account created by a computer account sigmaUser account creation disguised in a computer account	4	11
`unique_apps`	`gt`	`3` splunkAzure AD Multiple Service Principals Created by SP splunkAzure AD Multiple Service Principals Created by User splunkO365 Multiple Service Principals Created by SP splunkO365 Multiple Service Principals Created by User	4	4
`CommandLine`	`regex_match`	`(?i)searchroot\|objectcategory=\|userenum` splunkUser_Domain Enumeration Tool - Windows (PowerShell) splunkUser_Domain Enumeration Tool - Windows (Sysmon) splunkUser_Domain Enumeration Tool - Windows (Windows Event Log)	3	3
`EventID`	`eq`	`4104` splunkUser_Domain Enumeration Tool - Windows (PowerShell) splunkWindows Azure PowerShell Module Installation Via PowerShell Script splunkWindows ESX Admins Group Creation via PowerShell	3	269
`EventType`	`in`	`ProcessRollup2` elasticLinux User Added to Privileged Group elasticOpenSSL Password Hash Generation elasticPotential Linux Backdoor User Account Creation	3	119
`EventType`	`in`	`exec` elasticLinux User Added to Privileged Group elasticOpenSSL Password Hash Generation elasticPotential Linux Backdoor User Account Creation	3	180
`EventType`	`in`	`exec_event` elasticLinux User Added to Privileged Group elasticOpenSSL Password Hash Generation elasticPotential Linux Backdoor User Account Creation	3	135
`EventType`	`in`	`executed` elasticLinux User Added to Privileged Group elasticOpenSSL Password Hash Generation elasticPotential Linux Backdoor User Account Creation	3	85
`EventType`	`in`	`start` elasticLinux User Added to Privileged Group elasticOpenSSL Password Hash Generation elasticPotential Linux Backdoor User Account Creation	3	157
`OperationName`	`eq`	`Add User` kustoAccount created from non-approved sources kustoUser Account Created Using Incorrect Naming Format kustoUser account created without expected attributes defined	3	4
`data_stream.dataset`	`eq`	`aws.cloudtrail` elasticAWS IAM Create User via Assumed Role on EC2 Instance elasticAWS IAM Group Creation elasticAWS Sensitive IAM Operations Performed via CloudShell	3	143
`operationName`	`eq`	`Add service principal` splunkAzure AD Multiple Service Principals Created by SP splunkAzure AD Multiple Service Principals Created by User splunkAzure AD Service Principal Created	3	4
`process_basename`	`eq`	`net1.exe` elasticUser Account Creation splunkWindows Create Local Administrator Account Via Net splunkWindows ESX Admins Group Creation via Net	3	40
`security_result.action`	`eq`	`ALLOW` chronicleAWS Privilege Escalation Using IAM Access Key chronicleAWS Privilege Escalation Using IAM Login Profile chronicleGCP Free Gmail Domains Added To IAM Policy	3	102
`Action`	`eq`	`CREATE` kustoTailscale: New API access token or OAuth client created kustoTailscale: OAuth client or API key created with write scopes	2	4
`All_Changes.result_id`	`eq`	`4720` splunkShort Lived Windows Accounts splunkWindows Create Local Account	2	2

Exclusions (67 distinct)

These values appear most often in top-level exclusions.

Field	Kind	Value	Rules excluding
`SubjectUserName`	`eq`	`%sap_admin_users.user` chroniclesap security audit log user created deleted or unlocked chroniclesap user creates and uses new user	2
`actionName`	`in`	`removeAdmin` pantherDatabricks Account Admin Privileged Role Assignment pantherDatabricks Workspace Admin Privileged Role Assignment	2
`actionName`	`in`	`removePrincipalFromGroup` pantherDatabricks Account Admin Privileged Role Assignment pantherDatabricks Workspace Admin Privileged Role Assignment	2
`aws::errorCode`	`is_not_null`	sigmaIAM User Created pantherIAM Entity Created Without CloudFormation	2
`parent_process_basename`	`eq`	`net.exe` elasticUser Account Creation kustoAccount Creation	2
`CommunicationType`	`in`	`GroupChat` kustoAnomalous login followed by Teams action	1
`CommunicationType`	`in`	`OneonOne` kustoAnomalous login followed by Teams action	1
`Computer`	`eq`	`%domain_controllers%` sigmaHidden account creation (with fast deletion)	1
`DstUserName`	`eq`	`known_usrs` kustoPing Federate - New user SSO success login	1
`EventData`	`contains`	`gc_service.exe` kustoPowershell Empire Cmdlets Executed in Command Line	1
`EventData`	`contains`	`gc_worker.exe` kustoPowershell Empire Cmdlets Executed in Command Line	1
`Image`	`in`	`./usr/bin/qemu-aarch64-static` elasticShadow File Modification by Unusual Process	1
`Image`	`in`	`/bin/dnf` elasticShadow File Modification by Unusual Process	1
`Image`	`in`	`/usr/bin/containerd` elasticShadow File Modification by Unusual Process	1
`Image`	`in`	`/usr/bin/dnf` elasticShadow File Modification by Unusual Process	1

Create Account `T1136`

Events covered

Authoring guide

Fields filtered most (133 distinct)

Top indicator values (644 distinct)

Exclusions (67 distinct)

Rules under this technique

Sigma 41 rules

Elastic 24 rules

Splunk 44 rules

Kusto 29 rules

YARA-L 7 rules

Panther 29 rules

Create Account T1136

Events covered

Authoring guide

Fields filtered most (133 distinct)

Top indicator values (644 distinct)

Exclusions (67 distinct)

Rules under this technique

Sigma 41 rules

Elastic 24 rules

Splunk 44 rules

Kusto 29 rules

YARA-L 7 rules

Panther 29 rules

Create Account `T1136`