Local Account Creation Persistence

Overview

Local Account Creation Persistence is a technique used by adversaries to maintain long-term access to compromised systems by creating new local user accounts. This method supports persistence within the attack lifecycle by enabling attackers to regain access even after system reboots or credential changes.

Attack Objective

• Establish and maintain persistent access on a target system
• Supports the Persistence stage of the attack lifecycle
• Advances the attacker’s position by providing a reliable foothold for continued exploitation, lateral movement, or privilege escalation

How the Technique Works

Adversaries create new local user accounts on a compromised system to ensure continued access. These accounts may be granted administrative privileges or configured to evade detection. By leveraging legitimate system functionality for account management, attackers embed persistence mechanisms that survive system restarts and credential resets.

Common Methods & Variations

• Creation of standard or administrative local user accounts via command-line tools or scripting
• Use of native operating system utilities such as net user, PowerShell cmdlets, or system management interfaces
• Implementation in on-premises environments primarily, with some variations in cloud or virtualized systems where local accounts exist
• Living-off-the-land techniques leveraging built-in OS capabilities rather than deploying custom malware

Indicators of Compromise (IOCs)

• Unexpected creation of new local user accounts in system logs
• Authentication events involving newly created accounts
• Changes in user group memberships, especially addition to administrative groups
• Suspicious command-line activity related to account management tools

Detection Strategies

• Monitoring security event logs for account creation and privilege changes
• Behavioral analysis to identify anomalous account management activities
• Correlation of account creation events with other suspicious behaviors such as lateral movement or privilege escalation attempts

Mitigation & Prevention

• Enforce least privilege and restrict local account creation to authorized administrators
• Implement strong access controls and multi-factor authentication for administrative accounts
• Regularly audit local user accounts and group memberships for unauthorized changes
• Use endpoint protection solutions to monitor and alert on suspicious account management activities

Response Considerations

• Immediately disable or remove unauthorized local accounts
• Conduct thorough investigation to identify the scope and method of account creation
• Review and strengthen account management policies and monitoring controls
• Perform system hardening and credential resets as necessary to prevent re-establishment of persistence

Related Techniques

• Account Manipulation – modifying existing accounts to maintain access
• Credential Dumping – obtaining credentials to facilitate account creation
• Privilege Escalation – elevating privileges of created accounts
• Lateral Movement – using created accounts to access other systems

Mapping & References

• MITRE ATT&CK Tactic: Persistence
• MITRE ATT&CK Technique: T1136 – Create Account
• Public advisories and incident reports detailing use of local account creation for persistence