Command Line
net localgroup Administrators [USER] /add
Description
Used to add a new local administrator to the current machine.
Risk
High
Risk Reason
Adding a new local administrator is an action that can lead to immediate high-risk consequences if it is performed by a cyber-threat.
Fidelity
High
Fidelity Reason
It is extremely uncommon for new local administrators to be added to workstations or servers and should be audited due to the frequent abuse by cyber-threats.
Operating Systems
Killchain Phases
References
MITRE ATT&CK TECHNIQUES
URL: https://attack.mitre.org/techniques/T1136/001
Description: Adversaries may create a local account to maintain access to victim systems. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service. With a sufficient level of access, the net user /add command can be used to create a local account. On macOS systems the dscl -create command can be used to create a local account.
Such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
Tactics: