T1136.001Persistence
Local Account
Adversaries may create a local account to maintain access to victim systems. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service. For example, with a sufficient level of access, the Windows net user /add command can be used to create a local account. In Linux, the `useradd` command can be used…
CVEs2
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.2
Reports0
Detections
18 Sigma rules tagged T1136.001Local AccountT1136.00118 general rules
- Serv-U Exploitation CVE-2021-35211 by DEV-0322criticaltest
- Cisco Local Accountshightest
- Creation of a Local Hidden User Account by Registryhightest
- DarkGate - User Created Via Net.EXEhightest
- Hidden Local User Creationhightest
- New User Created Via Net.EXE With Never Expire Optionhightest
- Privileged User Has Been Createdhightest
- Suspicious Windows ANONYMOUS LOGON Local Account Createdhightest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Local Account
2 CVEs, by priority. Each link shows its badge.- CVE-2022-47966Zoho ManageEngine Multiple Products Remote Code Execution VulnerabilityZoho · ManageEngineKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1136.001Local Account+1 more · 3 reportsMITRE CTID mapping of the KEV entry · primary impact99.8%Top 0.04%87.6priority
- CVE-2022-21999Microsoft Windows Print Spooler Privilege Escalation VulnerabilityMicrosoft · WindowsKEVRansomwarePublic exploitHigh · 7.8T1078Valid AccountsT1059Command and Scripting Interpreter+3 moreMITRE CTID mapping of the KEV entry · follow-on activity41.0%Top 1.3%78.2priority