Procedure examples

Indrik Spider has created local system accounts and has added the accounts to privileged groups.

APT3 has been known to create or enable accounts, such as support_388945a0.

Kimsuky has created accounts with net user.

APT41 has created user accounts.

Dragonfly has created accounts on victims, including administrator accounts, some of which appeared to be tailored to each individual staging target.

Leafminer used a tool called Imecab to set up a persistent remote access account on the victim machine.

TeamTNT has created local privileged users on victim machines.

APT39 has created accounts on multiple compromised hosts to perform actions within the network.

APT5 has created Local Administrator accounts to maintain access to systems with short-cycle credential rotation.

Fox Kitten has created a local user account with administrator privileges.

Wizard Spider has created local administrator accounts to maintain persistence in compromised networks.

Daggerfly created a local account on victim machines to maintain access.

Magic Hound has created local accounts named `help` and `DefaultAccount` on compromised machines.

FIN13 has created MS-SQL local accounts in a compromised network.