> For the complete documentation index, see [llms.txt](https://www.ired.team/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.ired.team/offensive-security/persistence/t1136-create-account.md).

# Create Account

## Execution

{% code title="attacker\@victim" %}

```bash
net user test test123 /add /domain
```

{% endcode %}

## Observations

![commandline arguments](/files/-LINfFrXDDzNDHs8iJRT)

There is a whole range of interesting events that could be monitored related to new account creation:

![](/files/-LINfIDy9G7rtngKs27R)

Details for the newly added account are logged as event `4720` :

![](/files/-LINfJnvoffrohsKGUrk)

## References

{% embed url="<https://attack.mitre.org/wiki/Technique/T1136>" %}