Automation · API / MCP 中文

Technique note · T1136.001

Local Account

Adversaries may create a local account to maintain access to victim systems. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service. For example, with a sufficient level of access, the Windows <code>net user /add</code> command can be used to create a local account. In Linux, the `useradd` command can be used, while on macOS systems, the <code>dscl -create</code> command can be used. Local accounts may also be added to network devices, often via common Network Device CLI commands such as <code>username</code>, to ESXi servers via `esxcli system account add`, or to Kubernetes clusters using the `kubectl` utility. Adversaries may also create new local accounts on network firewall management consoles – for example, by exploiting a vulnerable firewall management system, threat actors may be able to establish super-admin accounts that could be used to modify firewall rules and gain further access to the network. Such accounts may be used to establish secondary credentialed access that does not require persistent remote access tools to be deployed on the system.

ATT&CK T1136.001 platforms — Status Active Version 20.1

Adversaries may create a local account to maintain access to victim systems. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service. For example, with a sufficient level of access, the Windows <code>net user /add</code> command can be used to create a local account. In Linux, the `useradd` command can be used, while on macOS systems, the <code>dscl -create</code> command can be used. Local accounts may also be added to network devices, often via common Network Device CLI commands such as <code>username</code>, to ESXi servers via `esxcli system account add`, or to Kubernetes clusters using the `kubectl` utility.12 Adversaries may also create new local accounts on network firewall management consoles – for example, by exploiting a vulnerable firewall management system, threat actors may be able to establish super-admin accounts that could be used to modify firewall rules and gain further access to the network.3 Such accounts may be used to establish secondary credentialed access that does not require persistent remote access tools to be deployed on the system.

  1. cisco_username_cmd
  2. Kubernetes Service Accounts Security
  3. Cyber Security News

Groups using this technique

GroupNameCountry
grp_g1034Daggerfly—
grp_g0117Fox Kitten—
grp_g1023APT5China
grp_g1045Salt Typhoon—
grp_g0119Indrik SpiderRussia
grp_g0077LeafminerIran
grp_g0035DragonflyRussia
grp_g0102Wizard SpiderRussia
grp_g1059NIMBUS MANTICORE—
grp_g0087APT39—
grp_g0022APT3China
grp_g0094KimsukyDPRK
grp_g0059Magic HoundIran
grp_g1016FIN13—
grp_g0139TeamTNT—
grp_g0096APT41China

Claims

No public claim points at this technique yet.

Auto-ingested and not human-reviewed; confidence and validity read by citation.