Procedure examples

TeamTNT has created local privileged users on victim machines.

APT39 has created accounts on multiple compromised hosts to perform actions within the network.

APT5 has created Local Administrator accounts to maintain access to systems with short-cycle credential rotation.

Fox Kitten has created a local user account with administrator privileges.

Wizard Spider has created local administrator accounts to maintain persistence in compromised networks.

Daggerfly created a local account on victim machines to maintain access.

Magic Hound has created local accounts named `help` and `DefaultAccount` on compromised machines.

FIN13 has created MS-SQL local accounts in a compromised network.

Hildegard has created a user named “monerodaemon”.

S-Type may create a temporary user on the system named `Lost_{Unique Identifier}` with the password `pond~!@6”{Unique Identifier}`.

DarkGate creates a local user account, SafeMode, via net user commands.

Carbanak can create a Windows account.

SMOKEDHAM has created user accounts.

ServHelper has created a new user named "supportaccount".

Calisto has the capability to add its own account to the victim's machine.

GoldenSpy can create new users on an infected system.

ZxShell has a feature to create local user accounts.

Mis-Type may create a temporary user on the system named `Lost_{Unique Identifier}`.

HiddenWasp creates a user account as a means to provide initial persistence to the compromised machine.

The net user username \password commands in Net can be used to create a local account.

Empire has a module for creating a local user if permissions allow.

Pupy can user PowerView to execute “net user” commands and create local system accounts.

Flame can create backdoor accounts with login “HelpAssistant” on domain connected systems if appropriate rights are available.

During the 2015 Ukraine Electric Power Attack, Sandworm Team created privileged domain accounts to be used for further exploitation and lateral movement.

During the 2016 Ukraine Electric Power Attack, Sandworm Team created two new accounts, “admin” and “система” (System). The accounts were then assigned to a domain matching local operation and were delegated new privileges.

BlackByte created privileged domain accounts during intrusions.

GALLIUM created high-privileged domain user accounts to maintain access to victim networks.

HAFNIUM has created domain accounts.

Medusa Group has created a domain account within the victim environment.

Wizard Spider has created and used new accounts within a victim's Active Directory environment to maintain persistence.

The net user username \password \domain commands in Net can be used to create a domain account.

Empire has a module for creating a new domain user if permissions allow.

Pupy can user PowerView to execute “net user” commands and create domain accounts.

PsExec has the ability to remotely create accounts on target systems.

APT29 can create new users through Azure AD.

LAPSUS$ has created global admin accounts in the targeted organization's cloud instances to gain persistence.

AADInternals can create new Azure AD users.

APT32 have replaced Microsoft Outlook's VbaProject.OTM file to install a backdoor macro for persistence.

Gamaredon Group has inserted malicious macros into existing documents, providing persistence when they are reopened. Gamaredon Group has loaded the group's previously delivered VBA project by relaunching Microsoft Outlook with the /altvba option, once the Application.Startup event is received.

During Operation AkaiRyū, MirrorFace loaded malicious Word templates containing VBA code leading to installation of UPPERCUT.

MuddyWater has used a Word Template, Normal.dotm, for persistence.

ROAMINGHOUSE has been loaded as a Word Template file when victims opened a decoy document placed in `%APPDATA%\Microsoft\Templates` alongside a ROAMINGHOUSE macro.

Cobalt Strike has the ability to use an Excel Workbook to execute additional code by enabling Office to trust macros and execute code without user permission.

BackConfig has the ability to use hidden columns in Excel spreadsheets to store executable files or commands for VBA macros.

APT28 has used the Office Test persistence mechanism within Microsoft Office by adding the Registry key HKCU\Software\Microsoft\Office test\Special\Perf to execute code.

Ruler can be used to automate the abuse of Outlook Forms to establish persistence.

OilRig has abused the Outlook Home Page feature for persistence. OilRig has also used CVE-2017-11774 to roll back the initial patch designed to protect against Home Page abuse.

Ruler can be used to automate the abuse of Outlook Home Pages to establish persistence.

Ruler can be used to automate the abuse of Outlook Rules to establish persistence.

Naikon has used the RoyalRoad exploit builder to drop a second stage loader, intel.wll, into the Word Startup folder on the compromised host.