Command Line
net user [username] [password] /add
Description
Creates a new user with the given username and password.
Risk
Low
Risk Reason
NET is commonly used to view details about a local or remote user, especially when troubleshooting permission or access issues.
Fidelity
Low
Fidelity Reason
Alerting on general NET commands will typically yield a high-false positive rate due to normal IT operations.
Operating Systems
Killchain Phases
References
MITRE ATT&CK TECHNIQUES
URL: https://attack.mitre.org/techniques/T1136/001
Description: Adversaries may create a local account to maintain access to victim systems. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service. With a sufficient level of access, the net user /add command can be used to create a local account. On macOS systems the dscl -create command can be used to create a local account.
Such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
Tactics:
URL: https://attack.mitre.org/techniques/T1136/002
Description: Adversaries may create a domain account to maintain access to victim systems. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover user, administrator, and service accounts. With a sufficient level of access, the net user /add /domain command can be used to create a domain account.
Such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
Tactics: