Create Account: Local Account

APT3 has been known to create or enable accounts, such as support_388945a0.^[3]

APT39 has created accounts on multiple compromised hosts to perform actions within the network.^[4]

APT41 has created user accounts.^[5]

APT5 has created Local Administrator accounts to maintain access to systems with short-cycle credential rotation.^[6]

Calisto has the capability to add its own account to the victim's machine.^[7]

Carbanak can create a Windows account.^[8]

DarkGate creates a local user account, SafeMode, via net user commands.^[9]

Dragonfly has created accounts on victims, including administrator accounts, some of which appeared to be tailored to each individual staging target.^[10]

Empire has a module for creating a local user if permissions allow.^[11]

FIN13 has created MS-SQL local accounts in a compromised network.^[12]

Flame can create backdoor accounts with login "HelpAssistant" on domain connected systems if appropriate rights are available.^[13][14]

Fox Kitten has created a local user account with administrator privileges.^[15]

GoldenSpy can create new users on an infected system.^[16]

HiddenWasp creates a user account as a means to provide initial persistence to the compromised machine.^[17]

Hildegard has created a user named "monerodaemon".^[18]

Kimsuky has created accounts with net user.^[19]

Leafminer used a tool called Imecab to set up a persistent remote access account on the victim machine.^[20]

Magic Hound has created local accounts named help and DefaultAccount on compromised machines.^[21][22]

Mis-Type may create a temporary user on the system named Lost_{Unique Identifier}.^[23]

The net user username \password commands in Net can be used to create a local account.^[24]

Pupy can user PowerView to execute "net user" commands and create local system accounts.^[25]

S-Type may create a temporary user on the system named Lost_{Unique Identifier} with the password pond~!@6"{Unique Identifier}.^[23]

ServHelper has created a new user named "supportaccount".^[26]

SMOKEDHAM has created user accounts.^[27]

TeamTNT has created local privileged users on victim machines.^[28]

Wizard Spider has created local administrator accounts to maintain persistence in compromised networks.^[29]

ZxShell has a feature to create local user accounts.^[30]

Use multi-factor authentication for user and privileged accounts.

Limit the number of accounts permitted to create other accounts. Limit the usage of local administrator accounts to be used for day-to-day operations that may expose them to potential adversaries.