Create Account

Persistence

Execution
[email protected]
net user test test123 /add /domain
Observations
commandline arguments
There is a whole range of interesting events that could be monitored related to new account creation:
Details for the newly added account are logged as event 4720 :
References
Create Account, Technique T1136 - Enterprise | MITRE ATT&CK®
​

Sticky Keys

AddMonitor()

Last modified 4yr ago