T1136.001 — Local Account

Tactic: Persistence · Platforms: Containers, ESXi, Linux, macOS, Network Devices, Windows

Adversaries may create a local account to maintain access to victim systems. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service. For example, with a sufficient level of access, the Windows net user…

Sub-technique of Create Account (T1136).

Sigma detection rules (6)

title: "T1136.001 Create Account: Local Account"
id: f760f328-378e-42ce-b0dc-a4343dbe143e
description: 'Detects local Windows account creation via Security event 4720. Tune using: ParentProcessName, TimeWindow, UserContext.'
references:
  - https://attack.mitre.org/techniques/T1136/001
author: Shahrukh Khan
date: 2026-06-24
license: MIT
tags:
  - attack.persistence
  - attack.t1136.001

logsource:
  product: windows
  service: security

detection:
  selection:
    EventID: 4720

  filter_system_account:
    TargetUserName|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and not filter_system_account

falsepositives:
  - Legitimate account provisioning by IT/helpdesk administrators or automated onboarding/deprovisioning scripts; tune with ParentProcessName/UserContext to distinguish authorized account creators.

level: medium

title: "T1136.001 Create Account: Local Account"
id: f9c15dad-35e8-40f9-bdd6-012667fbfee8
description: 'T1136.001 Detection Strategy - Local Account Creation Across Platforms. (Retargeted to the file_change auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: BinaryPath, ExecutionSource.'
references:
  - https://attack.mitre.org/techniques/T1136/001
author: Shahrukh Khan
date: 2026-01-28
license: MIT
tags:
  - attack.persistence
  - attack.t1136.001

logsource:
  category: file_change
  product: linux

detection:
  selection:
    type: PATH
    name: '/etc/passwd'
    nametype: NORMAL
  selection_exec:
    type: EXECVE
    a0|endswith:
      - '/useradd'
      - '/adduser'

  condition: 1 of selection*

falsepositives:
  - Legitimate provisioning workflows append new local accounts to /etc/passwd routinely; scope to unexpected source (interactive shell vs. CM tool) for higher fidelity.

level: medium

title: "T1136.001 Create Account: Local Account"
id: db06da11-82a7-4e7e-81b5-44a7416ea9e3
description: 'T1136.001 Detection Strategy - Local Account Creation Across Platforms. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: UsernamePattern, SessionOrigin.'
references:
  - https://attack.mitre.org/techniques/T1136/001
author: Shahrukh Khan
date: 2026-05-27
license: MIT
tags:
  - attack.persistence
  - attack.t1136.001

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith: '/sysadminctl'
    CommandLine|contains: '-addUser'

  condition: selection

falsepositives:
  - Provisioning tools creating legitimate local accounts during device setup.

level: high

title: "T1136.001 Create Account: Local Account"
id: 2f2c4782-a04a-451d-9329-9cb29d719d38
description: 'T1136.001 Detection Strategy - Local Account Creation Across Platforms. (Data Component: User Account Creation; baseline tier: fallback.) Tune using: PrivilegeLevel, RemoteSessionFlag.'
references:
  - https://attack.mitre.org/techniques/T1136/001
author: Shahrukh Khan
date: 2026-01-19
license: MIT
tags:
  - attack.persistence
  - attack.t1136.001

logsource:
  product: networkdevice
  service: syslog

detection:
  selection_useradd:
    Message|contains:
      - 'username'
      - 'privilege 15'
  selection_remote:
    Message|contains:
      - 'vty'
      - 'via SSH'
  condition: selection_useradd and selection_remote

falsepositives:
  - Legitimate onboarding of a new network administrator account performed through an approved remote change process will also match.

level: medium

title: "T1136.001 Create Account: Local Account"
id: 938b50be-67c3-4f51-9d73-1fca6a3ace5c
description: 'T1136.001 Detection Strategy - Local Account Creation Across Platforms. Fixes a broken argv match: auditd EXECVE splits arguments per position, so usermod -aG sudo appears as separate a1=-aG / a2=sudo tokens, not as a single "-aG sudo" string. The rule now checks the combined "-aG <group>" form and the split "-a -G <group>" form as distinct argv positions. (Data Component: Command Execution; baseline tier: fallback.) Tune using: ContainerContext, NamespaceScope.'
references:
  - https://attack.mitre.org/techniques/T1136/001
author: Shahrukh Khan
date: 2026-03-09
license: MIT
tags:
  - attack.persistence
  - attack.t1136.001

logsource:
  category: process_creation
  product: linux
  service: auditd

detection:
  selection_useradd:
    type: EXECVE
    a0|endswith:
      - '/useradd'
      - '/adduser'
    a1|contains: '-m'
  selection_usermod_combined:
    type: EXECVE
    a0|endswith: '/usermod'
    a1: '-aG'
    a2|contains:
      - 'sudo'
      - 'wheel'
  selection_usermod_split:
    type: EXECVE
    a0|endswith: '/usermod'
    a1: '-a'
    a2: '-G'
    a3|contains:
      - 'sudo'
      - 'wheel'

  condition: 1 of selection_*

falsepositives:
  - System administrators and provisioning automation legitimately create local accounts and add them to sudo/wheel during onboarding or configuration management runs.

level: medium

title: "T1136.001 Create Account: Local Account"
id: 6269ba38-094f-4d46-9711-6fa305a5cb29
description: 'T1136.001 Detection Strategy - Local Account Creation Across Platforms. (Retargeted to the process_creation ESXi telemetry that actually captures this techniques behavior; see logsource below.) Tune using: CommandOrigin.'
references:
  - https://attack.mitre.org/techniques/T1136/001
author: Shahrukh Khan
date: 2026-05-18
license: MIT
tags:
  - attack.persistence
  - attack.t1136.001

logsource:
  category: process_creation
  product: esxi
  service: shell

detection:
  selection:
    CommandLine|contains: 'esxcli system account add'

  condition: selection

falsepositives:
  - Authorized administrators provisioning a new local ESXi account during onboarding or break-glass account rotation; CommandOrigin (interactive TSM vs API-driven) should be reviewed to reduce noise.

level: high

Related sub-techniques

• T1136.003 Cloud Account
• T1136.002 Domain Account

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1136.001 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan