216.73.216.233

T1136.002: T1136.002

View on MITRE ATT&CK The MITRE Corporation · Published 28/01/2020 15:05 · Modified 27/03/2026 01:10

Essential information

MITRE technique ID
T1136.002
Confidence
100/100
Revoked
No
Published
28/01/2020 15:05
Modified
27/03/2026 01:10
Author / Source
The MITRE Corporation

Aliases

Domain Account

Platforms

windows macos linux

Description

Adversaries may create a domain account to maintain access to victim systems. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover user, administrator, and service accounts. With a sufficient level of access, the `net user /add /domain` command can be used to create a domain account.(Citation: Savill 1999) Such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.

Kill chain phases

Kill chainPhase
mitre-attack persistence

Marking (TLP)

TLP:CLEAR Copyright 2015-2025, The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.

External references

Related entities

Intrusion sets, malware, reports, vulnerabilities, indicators and other entities linked to this technique.