Skip to content
Sign In
Learn

T1136.001

Local Account

What it is

Attackers create a new account on a single host so they can sign in again later, even if the account they first used is disabled or its password is changed. It is a sub-technique of Create Account, under the Persistence tactic. A new local account, especially one added to the host's administrators group, gives the attacker a quiet way back in.

How adversaries use it

With administrator rights on a host, the attacker creates an account with a built-in command or a management tool, often with a name that looks like a service or support account, and adds it to the local administrators group. On Linux they add a user and may give it sudo rights. They then use the account for remote sign-ins weeks later.

Detect it in Elastic

Data source: Windows Security events (account management); Linux audit events

Key fields

event.code: 4720 when a user account is created user.target.name: the new account user.name: the account that created it event.code: 4732 when a member is added to a local group group.name: the group it was added to event.action: the Linux audit record for a new user, as Auditbeat names it host.name, @timestamp

Example event

{
  "host": {
    "name": "srv-552.corp.example"
  },
  "user": {
    "name": "a.halloran",
    "target": {
      "name": "hlpsvc_q2"
    }
  },
  "event": {
    "code": "4720"
  },
  "@timestamp": "2026-06-09T03:11:58.215Z"
}

Prebuilt Elastic rule: User or Group Creation/Modification

Hunt guidance

Account creation on member servers and workstations is uncommon in most networks, so every event is worth a look. Start with new local accounts: event.code: 4720. Then check whether each new account was added to a privileged group soon after: event.code: 4732. Look for accounts created outside IT's normal process, names that imitate service or support accounts, creation by an account that doesn't administer the host, and the new account signing in from another host later. The prebuilt rule named on this page covers the Linux side only; no prebuilt Elastic rule reads Windows event 4720, so on Windows this hunt is the detection.

Ruling out legitimate activity

Installers, imaging and management tools create local accounts, and administrators create them for maintenance. Check whether a change request or deployment explains the account, whether the creator belongs to IT, and whether the same account was created on many hosts at once by a known tool. A single account created by hand and added to administrators is the case to chase.

Telemetry needed

The log events that help detect this technique, from the Telemetry reference: which log source to collect, which event in it, and how to enable each one.

References

Practice it

No range covers this technique yet; the write-up above landed first. Ranges are added continuously; the ones live today are on the training ladder.