Automation · API / MCP 中文

Technique note · T1136.002

Domain Account

Adversaries may create a domain account to maintain access to victim systems. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover user, administrator, and service accounts. With a sufficient level of access, the <code>net user /add /domain</code> command can be used to create a domain account. Such accounts may be used to establish secondary credentialed access that does not require persistent remote access tools to be deployed on the system.

ATT&CK T1136.002 platforms — Status Active Version 20.1

Adversaries may create a domain account to maintain access to victim systems. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover user, administrator, and service accounts. With a sufficient level of access, the <code>net user /add /domain</code> command can be used to create a domain account.1 Such accounts may be used to establish secondary credentialed access that does not require persistent remote access tools to be deployed on the system.

  1. Savill 1999

Groups using this technique

GroupNameCountry
grp_g1043BlackByte—
grp_g0093GALLIUM—
grp_g1051Medusa Group—
grp_g0102Wizard SpiderRussia
grp_g0125HAFNIUM—

Claims

No public claim points at this technique yet.

Auto-ingested and not human-reviewed; confidence and validity read by citation.