T1136 Create Account

Technique: T1136
Tactics: Persistence
Research, 90 days: 0
KEV CVEs mapped: 10
SigmaHQ rules: 3
Elastic, Splunk: 35
thrunt rules: 0
Upstream: https://attack.mitre.org/techniques/T1136

MITRE description

Adversaries may create an account to maintain access to victim systems.(Citation: Symantec WastedLocker June 2020) With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that does not require persistent remote access tools to be deployed on the system. Accounts may be created on the local system or within a domain or cloud tenant. In cloud environments, adversaries may create accounts that only have access to specific services, which can reduce the chance of detection.

KEV CVEs mapped to this technique

MITRE CTID maps these KEV CVEs to this technique by hand. They are the actively exploited vulnerabilities behind this technique's KEV signal.

Detection coverage

SigmaHQ community rules

New Kubernetes Service Account Created (core)
AWS ElastiCache Security Group Created (core)
ESXi Account Creation Via ESXCLI (core)

Elastic and Splunk rules

Anthropic Organization User Invite Sent (elastic)
AWS IAM Create User via Assumed Role on EC2 Instance (elastic)
AWS IAM Group Creation (elastic)
AWS Sensitive IAM Operations Performed via CloudShell (elastic)
AWS IAM Sensitive Operations via Lambda Execution Role (elastic)
Entra ID External Guest User Invited (elastic)
Entra ID Service Principal Created (elastic)
Potential Persistence via File Modification (elastic)
GCP Service Account Creation (elastic)
New GitHub Owner Added (elastic)
New GitHub Personal Access Token (PAT) Added (elastic)
Attempt to Create Okta API Token (elastic)
OpenAI ChatGPT Enterprise User Invite Sent (elastic)
Spike in User Account Management Events (elastic)
ESXi Local Account Created (elastic)
Potential Linux Backdoor User Account Creation (elastic)
Linux Group Creation (elastic)
Linux User Account Creation (elastic)
Linux User Added to Privileged Group (elastic)
OpenSSL Password Hash Generation (elastic)
Shadow File Modification by Unusual Process (elastic)
User or Group Creation/Modification (elastic)
Suspicious Passwd File Event Action (elastic)
Potential Hidden Local User Account Creation (elastic)
FortiGate Administrator Account Creation from Unusual Source (elastic)

Showing 25 of 35.

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) at release r2026-07-01 plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.