# T1136.001 - Create Account: Local Account

## Description from ATT&CK

> Adversaries may create a local account to maintain access to victim systems. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service.
> 
> For example, with a sufficient level of access, the Windows <code>net user /add</code> command can be used to create a local account.  In Linux, the `useradd` command can be used, while on macOS systems, the <code>dscl -create</code> command can be used. Local accounts may also be added to network devices, often via common [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as <code>username</code>, to ESXi servers via `esxcli system account add`, or to Kubernetes clusters using the `kubectl` utility.(Citation: cisco_username_cmd)(Citation: Kubernetes Service Accounts Security)
> 
> Adversaries may also create new local accounts on network firewall management consoles – for example, by exploiting a vulnerable firewall management system, threat actors may be able to establish super-admin accounts that could be used to modify firewall rules and gain further access to the network.(Citation: Cyber Security News)
> 
> Such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.

[Source](https://attack.mitre.org/techniques/T1136/001)

## Atomic Tests

- [Atomic Test #1: Create a user account on a Linux system](#atomic-test-1-create-a-user-account-on-a-linux-system)
- [Atomic Test #2: Create a user account on a FreeBSD system](#atomic-test-2-create-a-user-account-on-a-freebsd-system)
- [Atomic Test #3: Create a user account on a MacOS system](#atomic-test-3-create-a-user-account-on-a-macos-system)
- [Atomic Test #4: Create a new user in a command prompt](#atomic-test-4-create-a-new-user-in-a-command-prompt)
- [Atomic Test #5: Create a new user in PowerShell](#atomic-test-5-create-a-new-user-in-powershell)
- [Atomic Test #6: Create a new user in Linux with `root` UID and GID.](#atomic-test-6-create-a-new-user-in-linux-with-root-uid-and-gid)
- [Atomic Test #7: Create a new user in FreeBSD with `root` GID.](#atomic-test-7-create-a-new-user-in-freebsd-with-root-gid)
- [Atomic Test #8: Create a new Windows admin user](#atomic-test-8-create-a-new-windows-admin-user)
- [Atomic Test #9: Create a new Windows admin user via .NET](#atomic-test-9-create-a-new-windows-admin-user-via-net)
- [Atomic Test #10: Create a Linux user via kubectl in a Pod](#atomic-test-10-create-a-linux-user-via-kubectl-in-a-pod)

### Atomic Test #1: Create a user account on a Linux system

Create a user via useradd

**Supported Platforms:** Linux

**auto_generated_guid:** `40d8eabd-e394-46f6-8785-b9bfa1d011d2`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| username | Username of the user to create | string | evil_user|

#### Attack Commands: Run with `bash`! Elevation Required (e.g. root or admin)

```bash
useradd -M -N -r -s /bin/bash -c evil_account #{username}
```

#### Cleanup Commands

```bash
userdel #{username}
```
### Atomic Test #2: Create a user account on a FreeBSD system

Create a user via pw

**Supported Platforms:** Linux

**auto_generated_guid:** `a39ee1bc-b8c1-4331-8e5f-1859eb408518`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| username | Username of the user to create | string | evil_user|

#### Attack Commands: Run with `sh`! Elevation Required (e.g. root or admin)

```sh
pw useradd #{username} -s /usr/sbin/nologin -d /nonexistent -c evil_account
```

#### Cleanup Commands

```sh
rmuser -y #{username}
```
### Atomic Test #3: Create a user account on a MacOS system

Creates a user on a MacOS system with dscl

**Supported Platforms:** macOS

**auto_generated_guid:** `01993ba5-1da3-4e15-a719-b690d4f0f0b2`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| username | Username of the user to create | string | evil_user|
| realname | 'realname' to record when creating the user | string | Evil Account|

#### Attack Commands: Run with `bash`! Elevation Required (e.g. root or admin)

```bash
dscl . -create /Users/#{username}
dscl . -create /Users/#{username} UserShell /bin/zsh
dscl . -create /Users/#{username} RealName "#{realname}"
dscl . -create /Users/#{username} UniqueID "1010"
dscl . -create /Users/#{username} PrimaryGroupID 80
dscl . -create /Users/#{username} NFSHomeDirectory /Users/#{username}
```

#### Cleanup Commands

```bash
dscl . -delete /Users/#{username}
```
### Atomic Test #4: Create a new user in a command prompt

Creates a new user in a command prompt. Upon execution, "The command completed successfully." will be displayed. To verify the
new account, run "net user" in powershell or CMD and observe that there is a new user named "T1136.001_CMD"

**Supported Platforms:** Windows

**auto_generated_guid:** `6657864e-0323-4206-9344-ac9cd7265a4f`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| username | Username of the user to create | string | T1136.001_CMD|
| password | Password of the user to create | string | T1136.001_CMD!|

#### Attack Commands: Run with `command_prompt`! Elevation Required (e.g. root or admin)

```cmd
net user /add "#{username}" "#{password}"
```

#### Cleanup Commands

```cmd
net user /del "#{username}" >nul 2>&1
```
### Atomic Test #5: Create a new user in PowerShell

Creates a new user in PowerShell. Upon execution, details about the new account will be displayed in the powershell session. To verify the
new account, run "net user" in powershell or CMD and observe that there is a new user named "T1136.001_PowerShell"

**Supported Platforms:** Windows

**auto_generated_guid:** `bc8be0ac-475c-4fbf-9b1d-9fffd77afbde`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| username | Username of the user to create | string | T1136.001_PowerShell|

#### Attack Commands: Run with `powershell`! Elevation Required (e.g. root or admin)

```powershell
New-LocalUser -Name "#{username}" -NoPassword
```

#### Cleanup Commands

```powershell
Remove-LocalUser -Name "#{username}" -ErrorAction Ignore
```
### Atomic Test #6: Create a new user in Linux with `root` UID and GID.

Creates a new user in Linux and adds the user to the `root` group. This technique was used by adversaries during the Butter attack campaign.

**Supported Platforms:** Linux

**auto_generated_guid:** `a1040a30-d28b-4eda-bd99-bb2861a4616c`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| username | Username of the user to create | string | butter|
| password | Password of the user to create | string | BetterWithButter|

#### Attack Commands: Ru