T1136 — Create Account

# T1136 - Create Account

## SOC Recommendation
Investigate Create Account activity in the context of Persistence: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.

## D3FEND Mappings
| D3FEND Technique | Relationship | Practical SOC Action |
|---|---|---|
| Local Account Monitoring | Detect | Monitor for Local Account Monitoring indicators relevant to this technique. |
| Agent Authentication | Harden | Apply Agent Authentication to reduce this technique's viability before an incident occurs. |
| Account Locking | Evict | Use Account Locking to remove the adversary's foothold once this technique is confirmed. |
| User Account Permissions | Isolate | Apply User Account Permissions to contain the blast radius once this technique is observed. |

## Investigation Steps
1. Review Defender for Endpoint / Defender XDR alerts and timeline for the affected host or identity.
2. Check Sentinel analytics rules and incidents correlated with this technique.
3. Review Entra ID sign-in and audit logs if the technique involves an identity or cloud resource.

## Evidence to Collect
- Host or resource affected
- Account or identity involved
- Timestamp of the activity
- Related process, file, or network artifact
- Any preceding or follow-on alerts

## Response Actions
| Action | Risk | Automation Safe | Approval Required |
|---|---|---|---|
| Disable the new account immediately | Medium | No | Yes |
| Investigate the creator account for further compromise | Low | No | Yes |
| Confirm with IT whether account creation was authorised | Low | Yes | No |

## KQL
```kql
SecurityEvent
| where TimeGenerated >= ago(5m)
| where EventID in (4720, 4732)
| extend NewAccount = tostring(TargetUserName)
| extend Creator = tostring(SubjectUserName)
| where Creator !in~ ("SYSTEM", "NT AUTHORITY\\SYSTEM")
| project
    TimeGenerated, Computer, Creator, NewAccount, EventID,
    Activity = iff(EventID == 4720, "Account Created", "Added to Admins Group")
| extend timestamp = TimeGenerated,
         HostCustomEntity = Computer,
         AccountCustomEntity = Creator
| order by TimeGenerated desc
```
```kql
(union isfuzzy=true
(SecurityEvent
| where EventID==4688
| where CommandLine has_any ("New-Mailbox","Update-RoleGroupMember") and CommandLine has "HealthMailbox55x2yq"
| project TimeGenerated, DeviceName = Computer, AccountName = SubjectUserName, AccountDomain = SubjectDomainName, ProcessName, ProcessNameFullPath = NewProcessName, EventID, Activity, CommandLine, EventSourceName, Type
| extend InitiatingProcessAccount = strcat(AccountDomain, "\\", AccountName)
),
(DeviceProcessEvents
| where ProcessCommandLine has_any ("New-Mailbox","Update-RoleGroupMember") and ProcessCommandLine has "HealthMailbox55x2yq"
| extend timestamp = TimeGenerated, AccountDomain = InitiatingProcessAccountDomain, AccountName = InitiatingProcessAccountName
| extend InitiatingProcessAccount = strcat(AccountDomain, "\\", AccountName)
)
)
| extend HostName = tostring(split(DeviceName, ".")[0]), DomainIndex = toint(indexof(DeviceName, '.'))
| extend HostNameDomain = iff(DomainIndex != -1, substring(DeviceName, DomainIndex + 1), DeviceName)
```
```kql
// High Severity - Attack Surface - Misconfiguration Detected
let timeFrame = 5m;
CyfirmaASConfigurationAlerts_CL
| where severity == 'Critical' and TimeGenerated between (ago(timeFrame) .. now())
| extend
    Description=description,
    FirstSeen=first_seen,
    LastSeen=last_seen,
    RiskScore=risk_score,
    Domain=sub_domain,
    TopDomain=top_domain,
    NetworkIP=ip,
    AlertUID=alert_uid,
    UID=uid,
    Softwares=software,
    WebAppFirewall=web_app_firewall,
    ClickJackingDefence=click_jacking_defence,
    ContentSecurityPolicy=content_security_policy,
    CookieXssProtection=cookie_xss_protection,
    DataInjectionDefence=data_injection_defence,
    DomainStatus=domain_status,
    MissingEPPCodes=missing_epp_codes,
    SecureCookie=secure_cookie,
    SetCookieHttpsOnly=set_cookie_https_only,
    XFrameOptions=x_frame_options,
    X_XssProtection=x_xss_protection,
    ProviderName='CYFIRMA',
    ProductName='DeCYFIR/DeTCT'
| project
    TimeGenerated,
    Description,
    Domain,
    TopDomain,
    RiskScore,
    FirstSeen,
    LastSeen,
    NetworkIP,
    AlertUID,
    UID,
    Softwares,
    WebAppFirewall,
    ClickJackingDefence,
    ContentSecurityPolicy,
    CookieXssProtection,
    DataInjectionDefence,
    DomainStatus,
    MissingEPPCodes,
    SecureCookie,
    SetCookieHttpsOnly,
    XFrameOptions,
    X_XssProtection,
    ProviderName,
    ProductName
```

## Escalation Criteria
- Create Account activity observed on a privileged account or critical system.
- Activity follows or precedes other suspicious behaviour in the same investigation.
- Automated triage cannot confidently rule out malicious intent.

## False Positive Considerations
- Legitimate administrative or maintenance activity matching this pattern.
- Approved security testing or red team exercise.
- Known benign software producing similar telemetry.

Generated by SOC Response Atlas by Basyrix.

Want to push this directly to Confluence? Upgrade to Basyrix Pro.

• /api/techniques/T1136.json
• /api/recommendations/T1136.json
• /api/d3fend/T1136.json
• /api/mappings/T1136.json
• /api/confluence/T1136.md

Example curl:

curl https://atlas.basyrix.com/api/recommendations/T1136.json

Response:

{
  "technique_id": "T1136",
  "name": "Create Account",
  "priority": "high",
  "status": "complete",
  "version": "0.1.0",
  "last_reviewed": "2026-07-23",
  "generated_by": "SOC Response Atlas by Basyrix",
  "tactics": [
    "Persistence"
  ],
  "platforms": [
    "Windows",
    "IaaS",
    "Linux",
    "macOS",
    "Network Devices",
    "Containers",
    "SaaS",
    "Office Suite",
    "Identity Provider",
    "ESXi"
  ],
  "summary": "Adversaries may create an account to maintain access to victim systems. With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system. Accounts may be created on the local system or within a domain or cloud tenant. In cloud environments, adversaries may create accounts that only have access to specific services, which can reduce the chance of detection.",
  "soc_recommendation": "Investigate Create Account activity in the context of Persistence: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.",
  "d3fend_mappings": [
    {
      "id": "D3-LAM",
      "name": "Local Account Monitoring",
      "relationship": "detect",
      "practical_action": "Monitor for Local Account Monitoring indicators relevant to this technique.",
      "tooling": [
        "Entra ID"
      ]
    },
    {
      "id": "D3-AA",
      "name": "Agent Authentication",
      "relationship": "harden",
      "practical_action": "Apply Agent Authentication to reduce this technique's viability before an incident occurs.",
      "tooling": [
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-AL",
      "name": "Account Locking",
      "relationship": "evict",
      "practical_action": "Use Account Locking to remove the adversary's foothold once this technique is confirmed.",
      "tooling": [
        "Entra ID"
      ]
    },
    {
      "id": "D3-UAP",
      "name": "User Account Permissions",
      "relationship": "isolate",
      "practical_action": "Apply User Account Permissions to contain the blast radius once this technique is observed.",
      "tooling": [
        "Entra ID"
      ]
    }
  ],
  "investigation_steps": {
    "microsoft": [
      "Review Defender for Endpoint / Defender XDR alerts and timeline for the affected host or identity.",
      "Check Sentinel analytics rules and incidents correlated with this technique.",
      "Review Entra ID sign-in and audit logs if the technique involves an identity or cloud resource."
    ],
    "generic": [
      "Confirm whether the observed create account activity matches expected administrative or application behaviour.",
      "Identify the host, account, or resource where the activity occurred and its business criticality.",
      "Check for related alerts before and after this activity to reconstruct the broader intrusion timeline.",
      "Real detection reference: \"New Local Admin Account Created\" -- Flags a new local user account created and/or added to the local Administrators group outside of SYSTEM-initiated provisioning - a common attacker persistence mechanism that survives credential rotation on domain accounts."
    ]
  },
  "evidence_to_collect": [
    "Host or resource affected",
    "Account or identity involved",
    "Timestamp of the activity",
    "Related process, file, or network artifact",
    "Any preceding or follow-on alerts"
  ],
  "response_actions": [
    {
      "name": "Disable the new account immediately",
      "category": "Response",
      "risk": "Medium",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide"
    },
    {
      "name": "Investigate the creator account for further compromise",
      "category": "Response",
      "risk": "Low",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide"
    },
    {
      "name": "Confirm with IT whether account creation was authorised",
      "category": "Response",
      "risk": "Low",
      "automation_safe": true,
      "approval_required": false,
      "tool": "See investigation guide"
    }
  ],
  "queries": {
    "kql": [
      {
        "name": "GEN-PS-003 — New Local Admin Account Created",
        "description": "Flags a new local user account created and/or added to the local Administrators group outside of SYSTEM-initiated provisioning - a common attacker persistence mechanism that survives credential rotation on domain accounts. (Source: Bell Integration baseline detection library, mapped via sub-technique T1136.001.)",
        "query": "SecurityEvent\n| where TimeGenerated >= ago(5m)\n| where EventID in (4720, 4732)\n| extend NewAccount = tostring(TargetUserName)\n| extend Creator = tostring(SubjectUserName)\n| where Creator !in~ (\"SYSTEM\", \"NT AUTHORITY\\\\SYSTEM\")\n| project\n    TimeGenerated, Computer, Creator, NewAccount, EventID,\n    Activity = iff(EventID == 4720, \"Account Created\", \"Added to Admins Group\")\n| extend timestamp = TimeGenerated,\n         HostCustomEntity = Computer,\n         AccountCustomEntity = Creator\n| order by TimeGenerated desc"
      },
      {
        "name": "0a3f4f4f-46ad-4562-acd6-f17730a5aef4 — Unusual identity creation using exchange powershell",
        "description": "The query below identifies creation of unusual identity by the Europium actor to mimic Microsoft Exchange Health Manager Service account using Exchange PowerShell commands Reference: https://www.microsoft.com/security/blog/2022/09/08/microsoft-investigates-iranian-attacks-against-the-albanian-government/' (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)",
        "query": "(union isfuzzy=true\n(SecurityEvent\n| where EventID==4688\n| where CommandLine has_any (\"New-Mailbox\",\"Update-RoleGroupMember\") and CommandLine has \"HealthMailbox55x2yq\"\n| project TimeGenerated, DeviceName = Computer, AccountName = SubjectUserName, AccountDomain = SubjectDomainName, ProcessName, ProcessNameFullPath = NewProcessName, EventID, Activity, CommandLine, EventSourceName, Type\n| extend InitiatingProcessAccount = strcat(AccountDomain, \"\\\\\", AccountName)\n),\n(DeviceProcessEvents\n| where ProcessCommandLine has_any (\"New-Mailbox\",\"Update-RoleGroupMember\") and ProcessCommandLine has \"HealthMailbox55x2yq\"\n| extend timestamp = TimeGenerated, AccountDomain = InitiatingProcessAccountDomain, AccountName = InitiatingProcessAccountName\n| extend InitiatingProcessAccount = strcat(AccountDomain, \"\\\\\", AccountName)\n)\n)\n| extend HostName = tostring(split(DeviceName, \".\")[0]), DomainIndex = toint(indexof(DeviceName, '.'))\n| extend HostNameDomain = iff(DomainIndex != -1, substring(DeviceName, DomainIndex + 1), DeviceName)"
      },
      {
        "name": "30206b45-75d2-4c6a-87c5-f0861c1f2870 — CYFIRMA - Attack Surface - Configuration High Rule",
        "description": "This alert is generated when CYFIRMA detects a critical misconfiguration in a public-facing asset or service. Such misconfigurations may include exposed admin interfaces, default credentials, open directory listings, or insecure protocols, which significantly increase the attack surface.\" (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)",
        "query": "// High Severity - Attack Surface - Misconfiguration Detected\nlet timeFrame = 5m;\nCyfirmaASConfigurationAlerts_CL\n| where severity == 'Critical' and TimeGenerated between (ago(timeFrame) .. now())\n| extend\n    Description=description,\n    FirstSeen=first_seen,\n    LastSeen=last_seen,\n    RiskScore=risk_score,\n    Domain=sub_domain,\n    TopDomain=top_domain,\n    NetworkIP=ip,\n    AlertUID=alert_uid,\n    UID=uid,\n    Softwares=software,\n    WebAppFirewall=web_app_firewall,\n    ClickJackingDefence=click_jacking_defence,\n    ContentSecurityPolicy=content_security_policy,\n    CookieXssProtection=cookie_xss_protection,\n    DataInjectionDefence=data_injection_defence,\n    DomainStatus=domain_status,\n    MissingEPPCodes=missing_epp_codes,\n    SecureCookie=secure_cookie,\n    SetCookieHttpsOnly=set_cookie_https_only,\n    XFrameOptions=x_frame_options,\n    X_XssProtection=x_xss_protection,\n    ProviderName='CYFIRMA',\n    ProductName='DeCYFIR/DeTCT'\n| project\n    TimeGenerated,\n    Description,\n    Domain,\n    TopDomain,\n    RiskScore,\n    FirstSeen,\n    LastSeen,\n    NetworkIP,\n    AlertUID,\n    UID,\n    Softwares,\n    WebAppFirewall,\n    ClickJackingDefence,\n    ContentSecurityPolicy,\n    CookieXssProtection,\n    DataInjectionDefence,\n    DomainStatus,\n    MissingEPPCodes,\n    SecureCookie,\n    SetCookieHttpsOnly,\n    XFrameOptions,\n    X_XssProtection,\n    ProviderName,\n    ProductName"
      }
    ],
    "spl": [],
    "esql": [
      {
        "name": "494ebba4-ecb7-4be4-8c6f-654c686549ad — Potential Linux Backdoor User Account Creation",
        "description": "(EQL) Identifies the attempt to create a new backdoor user by setting the user's UID to 0. Attackers may alter a user's UID to 0 to establish persistence on a system. (Source: Elastic's official detection-rules repository (Elastic License v2).)",
        "query": "process where host.os.type == \"linux\" and event.type == \"start\" and\nevent.action in (\"exec\", \"exec_event\", \"start\", \"ProcessRollup2\", \"executed\", \"process_started\") and\nprocess.name == \"usermod\" and process.args in (\"-u\", \"--uid\") and process.args == \"0\" and\nprocess.args in (\"-o\", \"--non-unique\")"
      },
      {
        "name": "e3a7b1c2-5d9f-4e8a-b6c3-2f1d4e5a6b7c — FortiGate SSO Login Followed by Administrator Account Creation",
        "description": "(EQL) This rule detects a FortiCloud SSO login followed by administrator account creation on the same FortiGate device within 15 minutes. This sequence is a high-confidence indicator of the FG-IR-26-060 attack pattern, where threat actors authenticate via SAML-based SSO bypass and immediately create local administrator accounts for persistence. (Source: Elastic's official detection-rules repository (Elastic License v2).)",
        "query": "sequence by observer.name with maxspan=15m\n  [authentication where data_stream.dataset == \"fortinet_fortigate.log\" and\n    event.action == \"login\" and event.outcome == \"success\" and\n    (fortinet.firewall.method == \"sso\" or fortinet.firewall.ui like~ \"sso*\")]\n  [any where data_stream.dataset == \"fortinet_fortigate.log\" and\n    event.code == \"0100044547\" and\n    fortinet.firewall.cfgpath == \"system.admin\" and\n    fortinet.firewall.action == \"Add\"]"
      }
    ]
  },
  "automation": {
    "safe": [
      "Add recommendation as Sentinel incident comment.",
      "Run enrichment queries.",
      "Create ServiceNow SecOps task."
    ],
    "approval_required": [
      "Contain or disable the affected host/account.",
      "Any change to production configuration."
    ]
  },
  "escalation_criteria": [
    "Create Account activity observed on a privileged account or critical system.",
    "Activity follows or precedes other suspicious behaviour in the same investigation.",
    "Automated triage cannot confidently rule out malicious intent."
  ],
  "false_positive_considerations": [
    "Legitimate administrative or maintenance activity matching this pattern.",
    "Approved security testing or red team exercise.",
    "Known benign software producing similar telemetry."
  ],
  "confluence": {
    "title": "T1136 - Create Account Response Guidance",
    "labels": [
      "mitre",
      "attack",
      "d3fend",
      "secops",
      "basyrix"
    ],
    "sections": [
      "summary",
      "d3fend_mappings",
      "investigation_steps",
      "response_actions",
      "queries",
      "automation",
      "escalation_criteria",
      "false_positive_considerations"
    ]
  }
}