Local Account

T1136.001

Sub-technique of T1136 Create Account.View on attack.mitre.org

About this technique

Adversaries may create a local account to maintain access to victim systems. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service.

For example, with a sufficient level of access, the Windows net user /add command can be used to create a local account. In Linux, the `useradd` command can be used, while on macOS systems, the dscl -create command can be used. Local accounts may also be added to network devices, often via common Network Device CLI commands such as username, to ESXi servers via `esxcli system account add`, or to Kubernetes clusters using the `kubectl` utility.

Adversaries may also create new local accounts on network firewall management consoles – for example, by exploiting a vulnerable firewall management system, threat actors may be able to establish super-admin accounts that could be used to modify firewall rules and gain further access to the network.

Such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.

Detection rules30

Rules on DetectionCode tagged with T1136.001.

Sigma16

Rule	Level	Log source
Cisco Local Accounts	high	cisco / NULL
Creation of a Local Hidden User Account by Registry	high	windows / registry_event
Hidden Local User Creation	high	windows / NULL
New User Created Via Net.EXE With Never Expire Option	high	windows / process_creation
Privileged User Has Been Created	high	linux / NULL
Suspicious Windows ANONYMOUS LOGON Local Account Created	high	windows / NULL
User Added to Remote Desktop Users Group	high	windows / process_creation
Creation Of An User Account	medium	linux / NULL
FortiGate - New Administrator Account Created	medium	fortigate / NULL
FortiGate - New Local User Created	medium	fortigate / NULL
New User Account Creation Attempt Via ADSI	medium	windows / ps_script
New User Account Creation Attempt Via ADSI in CommandLine	medium	windows / process_creation
New User Created Via Net.EXE	medium	windows / process_creation
PowerShell Create Local User	medium	windows / ps_script
Creation Of A Local User Account	low	macos / process_creation
Local User Creation	low	windows / NULL

Splunk14

Rule	Type	Risk	Data source
Cisco ASA - New Local User Account Created	Anomaly	NULL	Cisco ASA Logs
Create local admin accounts using net exe	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Detect New Local Admin account	TTP	NULL	Windows Event Log Security 4732, Windows Event Log Security 4720
ESXi Account Modified	Anomaly	NULL	VMWare ESXi Syslog
Linux Add User Account	Hunting	NULL	Sysmon for Linux EventID 1, Cisco Isovalent Process Exec
Linux Auditd Add User Account	Anomaly	NULL	Linux Auditd Proctitle
Linux Auditd Add User Account Type	Anomaly	NULL	Linux Auditd Add User
Short Lived Windows Accounts	TTP	NULL	Windows Event Log System 4720, Windows Event Log System 4726
Windows Create Local Account	Anomaly	NULL	Windows Event Log Security 4720
Windows Create Local Administrator Account Via Net	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows ESX Admins Group Creation Security Event	TTP	NULL	Windows Event Log Security 4727, Windows Event Log Security 4730, Windows Event Log Security 4737
Windows ESX Admins Group Creation via Net	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows ESX Admins Group Creation via PowerShell	TTP	NULL	Powershell Script Block Logging 4104
Windows Privileged Group Modification	TTP	NULL	Windows Event Log Security 4727, Windows Event Log Security 4731, Windows Event Log Security 4744, Windows Event Log Security 4749, Windows Event Log Security 4754, Windows Event Log Security 4756, Windows Event Log Security 4759, Windows Event Log Security 4783, Windows Event Log Security 4790

Groups14

Software15

Calisto Carbanak DarkGate Empire Flame GoldenSpy HiddenWasp Hildegard Mis-Type Net Pupy S-Type ServHelper SMOKEDHAM ZxShell

Campaigns1

Anthropic AI-orchestrated Campaign

Procedure examples30

Groups14

Used by	Procedure example
GroupAPT3	APT3 has been known to create or enable accounts, such as `support_388945a0`. aptsim
GroupAPT39	APT39 has created accounts on multiple compromised hosts to perform actions within the network. BitDefender Chafer May 2020
GroupAPT41	APT41 has created user accounts. FireEye APT41 Aug 2019
GroupAPT5	APT5 has created Local Administrator accounts to maintain access to systems with short-cycle credential rotation. Mandiant Pulse Secure Update May 2021
GroupDaggerfly	Daggerfly created a local account on victim machines to maintain access. Symantec Daggerfly 2023
GroupDragonfly	Dragonfly has created accounts on victims, including administrator accounts, some of which appeared to be tailored to each individual staging target. US-CERT TA18-074A
GroupFIN13	FIN13 has created MS-SQL local accounts in a compromised network. Sygnia Elephant Beetle Jan 2022
GroupFox Kitten	Fox Kitten has created a local user account with administrator privileges. ClearSky Pay2Kitten December 2020

View all 14 groups examples

Software15

Used by	Procedure example
MalwareCalisto	Calisto has the capability to add its own account to the victim's machine. Symantec Calisto July 2018
MalwareCarbanak	Carbanak can create a Windows account. FireEye CARBANAK June 2017
MalwareDarkGate	DarkGate creates a local user account, `SafeMode`, via `net user` commands. Ensilo Darkgate 2018
ToolEmpire	Empire has a module for creating a local user if permissions allow. Github PowerShell Empire
MalwareFlame	Flame can create backdoor accounts with login “HelpAssistant” on domain connected systems if appropriate rights are available. Kaspersky Flame Kaspersky Flame Functionality
MalwareGoldenSpy	GoldenSpy can create new users on an infected system. Trustwave GoldenSpy June 2020
MalwareHiddenWasp	HiddenWasp creates a user account as a means to provide initial persistence to the compromised machine. Intezer HiddenWasp Map 2019
MalwareHildegard	Hildegard has created a user named “monerodaemon”. Unit 42 Hildegard Malware

View all 15 software examples

Campaigns1

Used by	Procedure example
CampaignAnthropic AI-orchestrated Campaign	During the Anthropic AI-orchestrated Campaign, the adversary used Claude Code to create a local backdoor account to maintain access. Anthropic AI Orchestrated Campaign NOV 2025

References3

Cyber Security News Open source
Kaaviya. (n.d.). SuperBlack Actors Exploiting Two Fortinet Vulnerabilities to Deploy Ransomware. Retrieved September 22, 2025.
Kubernetes Service Accounts Security Open source
Kubernetes. (n.d.). Service Accounts. Retrieved July 14, 2023.
cisco_username_cmd Open source
Cisco. (2023, March 6). username - Cisco IOS Security Command Reference: Commands S to Z. Retrieved July 13, 2022.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.