Create Account
- ID
- T1136
- Tactics
- TA0003 Persistence
- Platforms
- Windows, IaaS, Linux, macOS, Network Devices, Containers, SaaS, Office Suite, Identity Provider, ESXi
- Data sources
- User Account Creation, Process Creation, File Modification, Command Execution, User Account Modification
- Source
- attack.mitre.org
- MITRE last modified
- 25 Oct 2025
Adversaries may create an account to maintain access to victim systems.[1] With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
Accounts may be created on the local system or within a domain or cloud tenant. In cloud environments, adversaries may create accounts that only have access to specific services, which can reduce the chance of detection.
Sub-techniques (3)
Detection
- DET0583 Detection Strategy for T1136 - Create Account across platforms
Data components: User Account Creation, Process Creation, File Modification, Command Execution, User Account Modification
Mitigations (4)
- M1026 Privileged Account Management
Limit the number of accounts with permissions to create other accounts. Do not allow domain administrator accounts to be used for day-to-day operations that may expose them to potential adversaries on unprivileged systems.
- M1028 Operating System Configuration
Protect domain controllers by ensuring proper security configuration for critical servers.
- M1030 Network Segmentation
Configure access controls and firewalls to limit access to domain controllers and systems used to create and manage accounts.
- M1032 Multi-factor Authentication
Use multi-factor authentication for user and privileged accounts.