T1136.002 Domain Account
sub-techniqueEnterpriseAdversaries may create a domain account to maintain access to victim systems. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover user, administrator, and service accounts. With a sufficient level of access, the <code>net user /add /domain</code> command can be used to create a domain account. Such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
platforms
Platforms this applies to.
tactics
ATT&CK tactics this technique serves.
sub-technique of
The broader entity this sits under.
mitigations
ATT&CK mitigations that reduce this.
detected by (5)
Data components that detect this.
countered by (D3FEND)
D3FEND countermeasures that counter this.
NIST CSF 2.0 — areas of relevance (Protect / Detect)
NIST CSF 2.0 areas this most relates to (evidence-ranked).
- DE.CMContinuous Monitoringmoderate · backed by 6 of 15 mapped controls
- PR.AAIdentity Management, Authentication, and Access Controlmoderate · backed by 6 of 15 mapped controls
- PR.DSData Securitymoderate · backed by 6 of 15 mapped controls
Derived from MITRE CTID (Apache-2.0) and the NIST 800-53 ↔ CSF crosswalk (public domain). Indicative relevance along the Protect/Detect axis — not a compliance assessment or coverage claim.
mitigating controls (15)
Security controls that mitigate this.
groups (5)
Threat groups associated with this.
software (4)
Malware and tools associated with this.
campaigns (2)
Campaigns that use this.
Detected by (Sigma) (6)
Sigma detection rules related to this.
source
Where this definition is published.