Home/ MITRE Matrix/ Persistence/ T1136.001

T1136.001Local Account

T1136.001 — Local Account is a MITRE ATT&CK technique in the Persistence tactic. Clankerusecase tracks 18 detection use cases covering it and 3 threat-intel articles citing it.

Persistence

View on the matrix → Filter Detection Library MITRE official spec ↗

18Use cases

3Articles

0Sub-techniques

1Tactic

↑ Parent technique: T1136 · Create Account

Use cases covering this technique (18)

[WEEKLY] Post-Auth Privilege Boundary Crossing on Edge/Management Appliances (low-priv -> admin within 10m) Internal exploit · alerting DSPDD [WEEKLY] Web-Server Process Post-Exploit Anchor: Plugin/Extension RCE Leading to Shell Spawn or Webroot Script Drop Internal install · alerting DSΣPDD Cisco ASA - New Local User Account Created ESCU actions · hunting P ESXi Account Modified ESCU actions · hunting P Detect New Local Admin account ESCU actions · alerting P Linux Add User Account ESCU actions · hunting P Linux Auditd Add User Account ESCU actions · hunting P Linux Auditd Add User Account Type ESCU actions · hunting P Short Lived Windows Accounts ESCU actions · alerting P Windows Create Local Account ESCU actions · hunting P Windows Create Local Administrator Account Via Net ESCU actions · hunting P Windows ESX Admins Group Creation Security Event ESCU actions · alerting P Windows ESX Admins Group Creation via Net ESCU actions · alerting P Windows ESX Admins Group Creation via PowerShell ESCU actions · alerting P Windows Privileged Group Modification ESCU actions · alerting P Create local admin accounts using net exe ESCU actions · alerting P [LLM] OkoBot RDP back-connection: local RDP user creation + firewall opening Bespoke install · hunting DSΣPDDCS [LLM] FileBrowser auto-account-creation: first-seen username in proxy auth header Bespoke install · hunting SP

Articles citing this technique (3)

crit OkoBot: new sophisticated malware framework targets cryptocurrency users art-169

crit [GHSA / CRITICAL] CVE-2026-54089: File Browser: Authentication Bypass via Proxy Auth Header Forgery art-204

crit ESET takes part in Operation Endgame to disrupt Amadey and Stealc art-301