T1136.002, Domain Account, covers adversaries who create an account in Active Directory to keep access. Domain accounts can be users, administrators or service accounts, and their permissions apply across the domain. MITRE files the technique under persistence for Linux, macOS and Windows.
How attackers use it
With sufficient access, the command net user /add /domain can create a domain account. MITRE says such accounts give secondary credentialed access that does not require a persistent remote access tool on the system. The page lists groups and tools that have used it, among them Wizard Spider and HAFNIUM, along with the tools Net and PsExec.
How to detect it
MITRE's detection covers three cases:
- Windows. Built-in tools such as
net user /add /domainor PowerShell. The chain is suspicious process execution on a domain controller followed by an account creation event, Event ID 4720, on the same host. - Linux. Domain management tools such as
realmd,samba-toolorldapmodifyadd a new user through command line utilities. LDAP traffic and a new entry in the directory result. - macOS. Clients joined to AD may script provisioning through
dsconfigad,dsclor LDAP scripts. Watch for such tools on a domain-joined system followed by authentication attempts from a previously unseen account.
Collect 4720 from every domain controller and compare each new account to your provisioning records.
How to reduce the risk
MITRE lists four mitigations. Use multi-factor authentication for user and privileged accounts. Limit the number of accounts permitted to create other accounts, and keep domain administrator accounts away from day to day use on unprivileged systems. Protect domain controllers with strong configuration, and use network segmentation so only the systems that manage accounts can reach them.
Quick check
Where should you collect Event ID 4720 for domain accounts?
From the domain controllers, where domain account creation is logged.
Sources
- MITRE ATT&CK, T1136.002 Domain Account
