Create Account: Local Account

APT3 has been known to create or enable accounts, such as support_388945a0.^[3]

APT39 has created accounts on multiple compromised hosts to perform actions within the network.^[4]

APT41 has created user accounts.^[5]

APT5 has created Local Administrator accounts to maintain access to systems with short-cycle credential rotation.^[6]

Calisto has the capability to add its own account to the victim's machine.^[7]

Carbanak can create a Windows account.^[8]

Daggerfly created a local account on victim machines to maintain access.^[9]

DarkGate creates a local user account, SafeMode, via net user commands.^[10]

Dragonfly has created accounts on victims, including administrator accounts, some of which appeared to be tailored to each individual staging target.^[11]

Empire has a module for creating a local user if permissions allow.^[12]

FIN13 has created MS-SQL local accounts in a compromised network.^[13]

Flame can create backdoor accounts with login "HelpAssistant" on domain connected systems if appropriate rights are available.^[14][15]

Fox Kitten has created a local user account with administrator privileges.^[16]

GoldenSpy can create new users on an infected system.^[17]

HiddenWasp creates a user account as a means to provide initial persistence to the compromised machine.^[18]

Hildegard has created a user named "monerodaemon".^[19]

Indrik Spider has created local system accounts and has added the accounts to privileged groups.^[20]

Kimsuky has created accounts with net user.^[21]

Leafminer used a tool called Imecab to set up a persistent remote access account on the victim machine.^[22]

Magic Hound has created local accounts named help and DefaultAccount on compromised machines.^[23][24]

Mis-Type may create a temporary user on the system named Lost_{Unique Identifier}.^[25]

The net user username \password commands in Net can be used to create a local account.^[26]

Pupy can user PowerView to execute "net user" commands and create local system accounts.^[27]

S-Type may create a temporary user on the system named Lost_{Unique Identifier} with the password pond~!@6"{Unique Identifier}.^[25]

ServHelper has created a new user named "supportaccount".^[28]

SMOKEDHAM has created user accounts.^[29]

TeamTNT has created local privileged users on victim machines.^[30]

Wizard Spider has created local administrator accounts to maintain persistence in compromised networks.^[31]

ZxShell has a feature to create local user accounts.^[32]

Use multi-factor authentication for user and privileged accounts.

Limit the number of accounts permitted to create other accounts. Limit the usage of local administrator accounts to be used for day-to-day operations that may expose them to potential adversaries.