T1136.002Persistence
Domain Account
Adversaries may create a domain account to maintain access to victim systems. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover user, administrator, and service accounts. With a sufficient level of access, the net user /add /domain command can be…
CVEs0
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.0
Reports0
Detections
6 Sigma rules tagged T1136.002Domain AccountT1136.0026 general rules
- PSEXEC Remote Execution File Artefacthightest
- Suspicious Windows ANONYMOUS LOGON Local Account Createdhightest
- ADCS - Certighost Ghost Machine Account Creationhighexperimental
- Manipulation of User Computer or Group Security Principals Across ADmediumtest
- New User Account Creation Attempt Via ADSImediumexperimental
- New User Account Creation Attempt Via ADSI in CommandLinemediumexperimental
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Domain Account
0 CVEs, by priority. Each link shows its badge.No CVEs are linked to this technique yet.