Procedure examples

Hildegard has created a user named “monerodaemon”.

S-Type may create a temporary user on the system named `Lost_{Unique Identifier}` with the password `pond~!@6”{Unique Identifier}`.

DarkGate creates a local user account, SafeMode, via net user commands.

Carbanak can create a Windows account.

SMOKEDHAM has created user accounts.

ServHelper has created a new user named "supportaccount".

Calisto has the capability to add its own account to the victim's machine.

GoldenSpy can create new users on an infected system.

ZxShell has a feature to create local user accounts.

Mis-Type may create a temporary user on the system named `Lost_{Unique Identifier}`.

HiddenWasp creates a user account as a means to provide initial persistence to the compromised machine.

The net user username \password commands in Net can be used to create a local account.

Empire has a module for creating a local user if permissions allow.

Pupy can user PowerView to execute “net user” commands and create local system accounts.

Flame can create backdoor accounts with login “HelpAssistant” on domain connected systems if appropriate rights are available.