EXPLORE
← Back to Explore
T1136.001

Local Account

Adversaries may create a local account to maintain access to victim systems. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service. For example, with a sufficient level of access, the Windows <code>net user /add</code> command can be used to create a local account. In Linux, the `useradd` command can be used, while on macOS systems, the <code>dscl -create</code> command can be used. Local accounts...

LinuxmacOSWindowsNetwork DevicesContainersESXi
42
Detections
3
Sources
14
Threat Actors

BY SOURCE

15elastic14sigma13splunk_escu

PROCEDURES (24)

Persist4 detections

Auto-extracted: 4 detections for persist

Persist4 detections

Auto-extracted: 4 detections for persist

General Monitoring3 detections

Auto-extracted: 3 detections for general monitoring

Privilege3 detections

Auto-extracted: 3 detections for privilege

Process Creation Monitoring3 detections

Auto-extracted: 3 detections for process creation monitoring

Privilege3 detections

Auto-extracted: 3 detections for privilege

Suspicious2 detections

Auto-extracted: 2 detections for suspicious

Remote2 detections

Auto-extracted: 2 detections for remote

Registry Monitoring2 detections

Auto-extracted: 2 detections for registry monitoring

Cloud2 detections

Auto-extracted: 2 detections for cloud

Cloud1 detections

Auto-extracted: 1 detections for cloud

Network Connection Monitoring1 detections

Auto-extracted: 1 detections for network connection monitoring

Service1 detections

Auto-extracted: 1 detections for service

Remote1 detections

Auto-extracted: 1 detections for remote

Remote1 detections

Auto-extracted: 1 detections for remote

Service1 detections

Auto-extracted: 1 detections for service

Powershell1 detections

Auto-extracted: 1 detections for powershell

Privilege1 detections

Auto-extracted: 1 detections for privilege

Suspicious1 detections

Auto-extracted: 1 detections for suspicious

Privilege1 detections

Auto-extracted: 1 detections for privilege

Bypass1 detections

Auto-extracted: 1 detections for bypass

Bypass1 detections

Auto-extracted: 1 detections for bypass

Powershell1 detections

Auto-extracted: 1 detections for powershell

Bypass1 detections

Auto-extracted: 1 detections for bypass

DETECTIONS (42)

Cisco ASA - New Local User Account Created
splunk_escu
Cisco Local Accounts
sigmahigh
Creation of a Hidden Local User Account
elastichigh
Creation of a Local Hidden User Account by Registry
sigmahigh
Creation Of A Local User Account
sigmalow
Creation Of An User Account
sigmamedium
Detect New Local Admin account
splunk_escu
ESXi Account Modified
splunk_escu
FortiGate - New Administrator Account Created
sigmamedium
FortiGate - New Local User Created
sigmamedium
FortiGate Administrator Account Creation from Unusual Source
elasticmedium
FortiGate SSO Login Followed by Administrator Account Creation
elastichigh
FortiGate Super Admin Account Creation
elasticmedium
Hidden Local User Creation
sigmahigh
Linux Add User Account
splunk_escu
Linux Auditd Add User Account
splunk_escu
Linux Auditd Add User Account Type
splunk_escu
Linux Group Creation
elasticlow
Linux User Account Creation
elasticlow
Linux User Added to Privileged Group
elasticlow
Local User Creation
sigmalow
New User Created Via Net.EXE
sigmamedium
New User Created Via Net.EXE With Never Expire Option
sigmahigh
OpenSSL Password Hash Generation
elasticmedium
Potential Hidden Local User Account Creation
elasticmedium
Potential Linux Backdoor User Account Creation
elastichigh
Potential Persistence via File Modification
elasticlow
PowerShell Create Local User
sigmamedium
Privileged User Has Been Created
sigmahigh
Shadow File Modification by Unusual Process
elasticlow
Short Lived Windows Accounts
splunk_escu
Suspicious Passwd File Event Action
elasticmedium
Suspicious Windows ANONYMOUS LOGON Local Account Created
sigmahigh
User Account Creation
elasticlow
User Added to Remote Desktop Users Group
sigmahigh
User or Group Creation/Modification
elasticlow
Windows Create Local Account
splunk_escu
Windows Create Local Administrator Account Via Net
splunk_escu
Windows ESX Admins Group Creation Security Event
splunk_escu
Windows ESX Admins Group Creation via Net
splunk_escu
Windows ESX Admins Group Creation via PowerShell
splunk_escu
Windows Privileged Group Modification
splunk_escu