Create Account: Domain Account
- ID
- T1136.002
- Tactics
- TA0003 Persistence
- Sub-technique of
- T1136 Create Account
- Platforms
- Linux, macOS, Windows
- Data sources
- User Account Creation, Process Creation, Command Execution, User Account Authentication, Logon Session Creation
- Source
- attack.mitre.org
- MITRE last modified
- 25 Oct 2025
Adversaries may create a domain account to maintain access to victim systems. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover user, administrator, and service accounts. With a sufficient level of access, the net user /add /domain command can be used to create a domain account.[1]
Such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
Detection
- DET0003 T1136.002 Detection Strategy - Domain Account Creation Across Platforms
Data components: User Account Creation, Process Creation, Command Execution, User Account Authentication, Logon Session Creation
Mitigations (4)
- M1026 Privileged Account Management
Limit the number of accounts with permissions to create other accounts. Do not allow domain administrator accounts to be used for day-to-day operations that may expose them to potential adversaries on unprivileged systems.
- M1028 Operating System Configuration
Protect domain controllers by ensuring proper security configuration for critical servers.
- M1030 Network Segmentation
Configure access controls and firewalls to limit access to domain controllers and systems used to create and manage accounts.
- M1032 Multi-factor Authentication
Use multi-factor authentication for user and privileged accounts.