T1136.001, Local Account, is the sub-technique of Create Account where an adversary adds a local account to keep access to a system. Local accounts are the ones configured by an organization for users, remote support, services or administration on a single system or service. The tactic is persistence. Platforms: Containers, ESXi, Linux, macOS, Network Devices and Windows.
How attackers use it
MITRE lists the commands by platform:
- Windows:
net user /add - Linux:
useradd - macOS:
dscl -create - Network devices: the
usernamecommand in the device CLI - ESXi:
esxcli system account add - Kubernetes: the
kubectlutility
The page also points at firewall management consoles. By exploiting a vulnerable management system, threat actors may be able to create super-admin accounts that can change firewall rules and give further access to the network.
The goal is to have credentialed access that does not depend on a persistent remote access tool being installed. Defenders who sweep for malware can miss an account. The page lists many groups and tools that have done this, such as Carbanak, Dragonfly and Empire.
How to detect it
MITRE's behavior chains by platform:
- Windows. An account creation event (4720) follows the creation of a process such as
powershell.exeornet.exe, or WMI activity. - Linux.
useradd,adduseror edits topasswdandshadow. - macOS.
dscl -createor GUI tools, with file changes in the local directory services database. - ESXi.
esxcliexecution followed by a successful change to the account database. - Containers. An account created in a running container, by
useraddor by editing/etc/passwddirectly. Runtime telemetry such as Falco or eBPF hooks can see it. - Network devices. The
usernamecommand or the REST API, visible in AAA logging or CLI history.
Pair every account creation event with who did it and from where. A creation event with no change ticket behind it is the finding.
How to reduce the risk
- Use multi-factor authentication for user and privileged accounts.
- Limit who can create accounts, and limit use of local administrator accounts for day to day work that exposes them to adversaries.
Check your own environment
Windows:
Get-LocalUser | Select-Object Name, Enabled, LastLogon
Get-LocalGroupMember -Group Administrators
Linux, find UID 0 accounts and review creation messages:
awk -F: '$3 == 0 {print $1}' /etc/passwd
grep -E 'useradd|new user' /var/log/auth.log
On Red Hat family systems use /var/log/secure.
Kubernetes, list service accounts across namespaces:
kubectl get serviceaccounts --all-namespaces
For each unexpected account, ask who requested it. If the answer is no one, disable it and investigate.
Quick check
Which Linux command does MITRE name for creating a local account?
useradd.
Why watch firewall management consoles?
A vulnerable management system can let attackers create super-admin accounts that change firewall rules and give further access to the network.
Sources
- MITRE ATT&CK, T1136.001 Local Account
