T1136.002: Domain Account
Adversaries may create a domain account to maintain access to victim systems. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover user, administrator, and service accounts. With a sufficient level of access, the net user /add /domain command can be used to create a domain account.[1]
Such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
Analyst context for executives and security teams
Domain account creation is a persistence risk because a new Active Directory-managed user, admin, or service account can give an intruder credentialed access without keeping malware or a remote-access tool running. For leaders, the key issue is identity control: can the organization quickly prove who is allowed to create domain accounts, detect unauthorized creations, and disable them during an incident?
Executive priority
Prioritize this as an identity governance and incident-response readiness issue. Unauthorized domain accounts can undermine business continuity by preserving access across many systems and services in the domain. Evidence of account creation is also important for audit, compliance, and post-incident scoping. The supplied relationships include use in Ukraine electric power attack campaigns, so organizations with cyber-physical operations should ensure domain account governance is included in resilience planning.
Technical view
Validate monitoring around Active Directory Domain Services account creation across Windows, Linux, and macOS environments where domain administration or tooling may be used. ATT&CK provides no official detection text, but the supplied references identify Microsoft event 4720, “A user account was created,” and the technique description notes domain account creation using Windows net.exe capabilities when sufficient access exists. SOC and IR teams should correlate new domain users, administrators, and service accounts with the actor that created them, source host, command-line/process evidence, group membership changes, and approved change tickets. Relationship context also links PsExec, Net, Pupy, and Empire, so review whether legitimate administration and post-exploitation-style tooling can be separated by user, host, timing, and change context.
Likely telemetry
- Active Directory domain controller security audit logs for user account creation, including Microsoft event 4720 where available
- Directory service account-management records showing creator account, target account, timestamps, and attributes
- Process creation and command-line telemetry for administrative utilities such as Net and remote execution tooling such as PsExec
- Endpoint telemetry from Windows, Linux, and macOS systems used for domain administration
- Group membership, privilege assignment, and service account change logs
Detection direction
- Confirm domain account creation events are collected from domain controllers and retained long enough for incident scoping.
- Alert on domain accounts created by unusual users, from unusual hosts, outside approved provisioning windows, or without matching IAM/change records.
- Tune detections to reduce false positives from help desk, IAM automation, and normal service-account provisioning while preserving accountability for the creating principal.
- Correlate new account creation with subsequent privilege changes, remote execution, or use of administrative tools.
- Treat missing creator, source host, or command-line context as a coverage gap rather than assuming the activity is benign.
Mitigation priorities
- Restrict who can create domain accounts using privileged account management, RBAC, and least privilege.
- Require strong authentication, including MFA where applicable, for privileged and account-provisioning workflows.
- Harden operating system and administrative configurations to limit abuse of built-in account-management functions.
- Segment networks and administrative paths so domain administration is not broadly reachable from standard user or workstation segments.
- Regularly review domain users, administrator accounts, and service accounts for ownership, business justification, and stale or unauthorized entries.
Analyst notes and limits
This technique is a sub-technique of Create Account and is mapped to the persistence tactic. The supplied relationship set shows relevance across espionage, ransomware, public post-exploitation tools, and cyber-physical campaign reporting, but those relationships should be used for defensive prioritization rather than attribution. Local identity architecture, domain controller logging, IAM workflow design, and administrative operating model determine actual exposure and detection quality.
ATT&CK does not provide official detection guidance for this object. The object describes Active Directory domain accounts, while the platform list includes Linux, macOS, and Windows; local validation is required to determine where domain administration can occur and where telemetry is available. This summary does not establish active exploitation or organization-specific risk.
Domain Account
Adversaries may create a domain account to maintain access to victim systems. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover user, administrator, and service accounts. With a sufficient level of access, the net user /add /domain command can be used to create a domain account.[1]
Such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Related techniques
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1136 | Create Account | This object subtechnique of Create Account. |
Groups, software, and campaigns
G0093: GALLIUM
GALLIUM is a cyberespionage group that has been active since at least 2012, primarily targeting telecommunications companies, financial institutions, and government entities in Afghanistan, Australia, Belgium, Cambodia, Malaysia, Mozambique, the Philippines, Russia, and Vietnam. This group is particularly known for launching Operation Soft Cell, a long-term campaign targeting telecommunications providers.[1] Security researchers have identified GALLIUM as a likely Chinese state-sponsored group, based in part on tools used and TTPs commonly associated with Chinese threat actors.[1][2][3]
G1043: BlackByte
BlackByte is a ransomware threat actor operating since at least 2021. BlackByte is associated with several versions of ransomware also labeled BlackByte Ransomware. BlackByte ransomware operations initially used a common encryption key allowing for the development of a universal decryptor, but subsequent versions such as BlackByte 2.0 Ransomware use more robust encryption mechanisms. BlackByte is notable for operations targeting critical infrastructure entities among other targets across North America.[1][2][3][4][5]
G0102: Wizard Spider
Wizard Spider is a Russia-based financially motivated threat group originally known for the creation and deployment of TrickBot since at least 2016. Wizard Spider possesses a diverse arsenal of tools and has conducted ransomware campaigns against a variety of organizations, ranging from major corporations to hospitals.[1][2][3]
G1051: Medusa Group
Medusa Group has been active since at least 2021 and was initially operated as a closed ransomware group before evolving into a Ransomware-as-a-Service (RaaS) operation. Some reporting indicates that certain attacks may still be conducted directly by the ransomware’s core developers. Public sources have also referred to the group as “Spearwing” or “Medusa Actors.” [1] [2] Medusa Group employs living-off-the-land techniques, frequently leveraging publicly available tools and common remote management software to conduct operations. The group engages in double extortion tactics, exfiltrating data prior to encryption and threatening to publish stolen information if ransom demands are not met. [3] For initial access, Medusa Group has exploited publicly known vulnerabilities, conducted phishing campaigns, and used credentials or access purchased from Initial Access Brokers (IABs). The group is opportunistic and has targeted a wide range of sectors globally. [4]
G0125: HAFNIUM
HAFNIUM is a likely state-sponsored cyber espionage group operating out of China that has been active since at least January 2021. HAFNIUM primarily targets entities in the US across a number of industry sectors, including infectious disease researchers, law firms, higher education institutions, defense contractors, policy think tanks, and NGOs. HAFNIUM has targeted remote management tools and cloud software for intial access and has demonstrated an ability to quickly operationalize exploits for identified vulnerabilities in edge devices.[1][2][3]
S0192: Pupy
Pupy is an open source, cross-platform (Windows, Linux, OSX, Android) remote administration and post-exploitation tool. [1] It is written in Python and can be generated as a payload in several different ways (Windows exe, Python file, PowerShell oneliner/file, Linux elf, APK, Rubber Ducky, etc.). [1] Pupy is publicly available on GitHub. [1]
S0029: PsExec
S0039: Net
The Net utility is a component of the Windows operating system. It is used in command-line operations for control of users, groups, services, and network connections. [1]
Net has a great deal of functionality, [2] much of which is useful for an adversary, such as gathering system and network information for Discovery, moving laterally through SMB/Windows Admin Shares using net use commands, and interacting with services. The net1.exe utility is executed for certain functionality when net.exe is run and can be used directly in commands such as net1 user.
S0363: Empire
Empire is an open-source, cross-platform remote administration and post-exploitation framework that is publicly available on GitHub. While the tool itself is primarily written in Python, the post-exploitation agents are written in pure PowerShell for Windows and Python for Linux/macOS. Empire was one of five tools singled out by a joint report on public hacking tools being widely used by adversaries.[1][2][3]
C0028: 2015 Ukraine Electric Power Attack
2015 Ukraine Electric Power Attack was a Sandworm Team campaign during which they used BlackEnergy (specifically BlackEnergy3) and KillDisk to target and disrupt transmission and distribution substations within the Ukrainian power grid. This campaign was the first major public attack conducted against the Ukrainian power grid by Sandworm Team.
C0025: 2016 Ukraine Electric Power Attack
2016 Ukraine Electric Power Attack was a Sandworm Team campaign during which they used Industroyer malware to target and disrupt distribution substations within the Ukrainian power grid. This campaign was the second major public attack conducted against Ukraine by Sandworm Team.[1][2]
All related ATT&CK context
Mitigation direction
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.1 | Current bundle | a3913df746a8… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
Savill 1999
Savill, J. (1999, March 4). Net.exe reference. Retrieved September 22, 2015.
Open source URL -
[2]
Microsoft User Creation Event
Lich, B., Miroshnikov, A. (2017, April 5). 4720(S): A user account was created. Retrieved June 30, 2017.
Open source URL -
[3]
mitre-attack T1136.002Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.