Create Account

What is Create Account?

Adversaries may create an account to maintain access to victim systems. With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that does not require persistent remote access tools to remain installed on the system. Accounts may be created on the local system or within a domain. In cloud environments, adversaries may create accounts within the victim cloud tenant to maintain access. Creating accounts is particularly valuable for persistence because it survives reboots, can be hidden from casual inspection, and provides a mechanism for returning to a compromised environment even after the initial foothold is remediated. Attackers often create accounts with names that blend in with legitimate accounts, use similar naming conventions to system accounts, or add themselves to existing groups to elevate privileges while minimizing the appearance of new account creation.

“Create Account is documented as technique T1136 in the MITRE ATT&CK knowledge base under the Persistence tactic. Detection requires visibility into SIEM, XDR telemetry.”

Detection Strategies

The following detection strategies help SOC analysts identify Create Account activity. These methods apply across SIEM, XDR environments and can be implemented as detection rules, correlation queries, or behavioral analytics in your security platform.

1. 1

   Monitor Windows Event ID 4720 for new local account creation and Event ID 4728 for additions to security-enabled global groups, alerting on account creation outside of established IT change management processes.

2. 2

   Track Active Directory changes for new user account creation, particularly accounts created outside business hours, accounts created by non-IT staff, or accounts immediately added to privileged groups like Domain Admins.

3. 3

   Monitor cloud platform audit logs for IAM user creation, service account creation, and privilege assignment events, correlating with change management records to identify unauthorized account creation.

4. 4

   Establish baseline account creation rates and alert on deviations, as attackers may create multiple accounts rapidly across different systems as part of establishing redundant persistence mechanisms.

5. 5

   Review newly created accounts for suspicious attributes such as long password expiration, no expiration date, membership in administrator groups, or creation from unusual source IP addresses.

Example Alerts

These realistic alert examples show what Create Account looks like in your security tools. Use them to tune detection rules and train analysts to recognize true positives versus false positives in live environments.

Frequently Asked Questions

How do SOC analysts detect Create Account?

SOC analysts detect Create Account (T1136) by monitoring SIEM, XDR telemetry for behavioral anomalies and specific indicators. Key detection methods include monitor windows event id 4720 for new local account creation and event id 4728 for additions to security-enabled global groups, alerting on account cr. SOCSimulator provides hands-on practice detecting this technique with realistic alerts.

What security tools are used to detect Create Account?

Create Account can be detected using SIEM, XDR platforms. SIEM tools are particularly effective for this technique because they provide visibility into the persistence phase of the attack chain. SOCSimulator simulates all three tool types for hands-on training.

How common is Create Account in real-world attacks?

Create Account is a well-documented MITRE ATT&CK technique in the Persistence tactic. It appears in threat intelligence reports from multiple security vendors and has been observed in campaigns by various threat actor groups. SOCSimulator includes realistic Create Account scenarios based on documented attack patterns, helping analysts build detection intuition.

Can I practice detecting Create Account for free?

Yes. SOCSimulator offers free forever access to training scenarios, including Persistence techniques like Create Account. You can investigate realistic alerts in guided Operations rooms, build detection skills with SIEM, XDR, and Firewall interfaces, and test yourself under pressure in Shift Mode. No credit card required.