Create Account: Local Account

APT3 has been known to create or enable accounts, such as support_388945a0.^[4]

APT39 has created accounts on multiple compromised hosts to perform actions within the network.^[5]

APT41 has created user accounts.^[6]

APT5 has created Local Administrator accounts to maintain access to systems with short-cycle credential rotation.^[7]

Calisto has the capability to add its own account to the victim's machine.^[8]

Carbanak can create a Windows account.^[9]

Daggerfly created a local account on victim machines to maintain access.^[10]

DarkGate creates a local user account, SafeMode, via net user commands.^[11]

Dragonfly has created accounts on victims, including administrator accounts, some of which appeared to be tailored to each individual staging target.^[12]

Empire has a module for creating a local user if permissions allow.^[13]

FIN13 has created MS-SQL local accounts in a compromised network.^[14]

Flame can create backdoor accounts with login "HelpAssistant" on domain connected systems if appropriate rights are available.^[15][16]

Fox Kitten has created a local user account with administrator privileges.^[17]

GoldenSpy can create new users on an infected system.^[18]

HiddenWasp creates a user account as a means to provide initial persistence to the compromised machine.^[19]

Hildegard has created a user named "monerodaemon".^[20]

Indrik Spider has created local system accounts and has added the accounts to privileged groups.^[21]

Kimsuky has created accounts with net user.^[22]

Leafminer used a tool called Imecab to set up a persistent remote access account on the victim machine.^[23]

Magic Hound has created local accounts named help and DefaultAccount on compromised machines.^[24][25]

Mis-Type may create a temporary user on the system named Lost_{Unique Identifier}.^[26]

The net user username \password commands in Net can be used to create a local account.^[27]

Pupy can user PowerView to execute "net user" commands and create local system accounts.^[28]

S-Type may create a temporary user on the system named Lost_{Unique Identifier} with the password pond~!@6"{Unique Identifier}.^[26]

ServHelper has created a new user named "supportaccount".^[29]

SMOKEDHAM has created user accounts.^[30]

TeamTNT has created local privileged users on victim machines.^[31]

Wizard Spider has created local administrator accounts to maintain persistence in compromised networks.^[32]

ZxShell has a feature to create local user accounts.^[33]

Use multi-factor authentication for user and privileged accounts.

Limit the number of accounts permitted to create other accounts. Limit the usage of local administrator accounts to be used for day-to-day operations that may expose them to potential adversaries.