Create Account

What is Create Account?

“Create Account is documented as technique T1136 in MITRE ATT&CK® v19.1 under the Persistence tactic. Detection requires visibility into SIEM, XDR telemetry.”

Detection Strategies

The following detection strategies help SOC analysts identify Create Account activity. These methods apply across SIEM, XDR environments and can be implemented as detection rules, correlation queries, or behavioral analytics in your security platform.

1. 1

   Monitor Windows Event ID 4720 for new local account creation and Event ID 4728 for additions to security-enabled global groups, alerting on account creation outside of established IT change management processes.

2. 2

   Track Active Directory changes for new user account creation, particularly accounts created outside business hours, accounts created by non-IT staff, or accounts immediately added to privileged groups like Domain Admins.

3. 3

   Monitor cloud platform audit logs for IAM user creation, service account creation, and privilege assignment events, correlating with change management records to identify unauthorized account creation.

4. 4

   Establish baseline account creation rates and alert on deviations, as attackers may create multiple accounts rapidly across different systems as part of establishing redundant persistence mechanisms.

5. 5

   Review newly created accounts for suspicious attributes such as long password expiration, no expiration date, membership in administrator groups, or creation from unusual source IP addresses.

Example Alerts

These realistic alert examples show what Create Account looks like in your security tools. Use them to tune detection rules and train analysts to recognize true positives versus false positives in live environments.

Frequently Asked Questions

How do SOC analysts detect Create Account?

Detection centers on SIEM, XDR telemetry for the persistence phase of the attack. Monitor Windows Event ID 4720 for new local account creation and Event ID 4728 for additions to security-enabled global groups, alerting on account creation outside of established IT change management processes. Track Active Directory changes for new user account creation, particularly accounts created outside business hours, accounts created by non-IT staff, or accounts immediately added to privileged groups like Domain Admins.

What does a Create Account alert look like?

A representative SIEM detection is "New Local Administrator Account Created" (high severity): Windows Event 4720 detected on finance workstation FIN-WS-042: new local user account "helpdesk_support" created, immediately followed by Event 4732 adding account to Administrators group. Account creation was performed by the currently logged-in user who does not have IT administrative responsibilities, suggesting post-compromise persistence.

Which tools detect Create Account, and how can I practice?

Create Account (T1136) is best surfaced with SIEM, XDR telemetry, which exposes the persistence signals described above. Practice detecting it on those exact consoles in SOCSimulator Operations, free.