T1136.002 — Domain Account

Tactic: Persistence · Platforms: Linux, macOS, Windows

Adversaries may create a domain account to maintain access to victim systems. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover user, administrator,…

Sub-technique of Create Account (T1136).

Sigma detection rules (3)

T1136.002 Create Account: Domain Account

title: "T1136.002 Create Account: Domain Account"
id: a4da6e8e-af31-49fe-9d75-62cb23fb08a0
description: 'Detects domain account creation via Security EventID 4720. (Data Component: User Account Creation; baseline tier: windows-eventid.) Tune using: TimeWindow, ParentProcessName, UserContext, HostRole.'
references:
  - https://attack.mitre.org/techniques/T1136/002
author: Shahrukh Khan
date: 2026-05-21
license: MIT
tags:
  - attack.persistence
  - attack.t1136.002

logsource:
  product: windows
  service: security

detection:
  selection:
    EventID: '4720'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'
  condition: selection and not filter_system_account

falsepositives:
  - Legitimate account provisioning.

level: medium

T1136.002 Create Account: Domain Account

title: "T1136.002 Create Account: Domain Account"
id: 3da5d9b3-3e16-4f65-98af-9dc473467025
description: 'T1136.002 Detection Strategy - Domain Account Creation Across Platforms. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: DomainToolUsed, TrafficWindow, SessionType.'
references:
  - https://attack.mitre.org/techniques/T1136/002
author: Shahrukh Khan
date: 2026-04-10
license: MIT
tags:
  - attack.persistence
  - attack.t1136.002

logsource:
  category: process_creation
  product: linux

detection:
  selection:
    type: EXECVE
    a0|endswith: '/net'
    a1: 'rpc'
    a2: 'user'
  selection_samba:
    type: EXECVE
    a0|endswith: '/samba-tool'
    a1: 'user'
    a2: 'create'

  condition: 1 of selection*

falsepositives:
  - samba-tool/net rpc user creation is a normal domain-admin task on Samba AD DC hosts; scope to unexpected source hosts/accounts performing domain-account creation.

level: medium

T1136.002 Create Account: Domain Account

title: "T1136.002 Create Account: Domain Account"
id: 77189082-0cd2-4ac1-a3ff-58cc15b993be
description: 'T1136.002 Detection Strategy - Domain Account Creation Across Platforms. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: EnrollmentStatus, AccountType.'
references:
  - https://attack.mitre.org/techniques/T1136/002
author: Shahrukh Khan
date: 2026-01-10
license: MIT
tags:
  - attack.persistence
  - attack.t1136.002

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith: '/dsconfigad'
    CommandLine|contains: '-useraccount'

  condition: selection

falsepositives:
  - Active Directory binding and domain account provisioning tools legitimately use dsconfigad.

level: medium

Related sub-techniques

Explore