attack.t1136 | Detection.FYI

New Kubernetes Service Account Created

Feb 3, 2025 · attack.t1136 ·
Share on:

Detects creation of new Kubernetes service account, which could indicate an attacker's attempt to persist within a cluster.

Read More
ESXi Account Creation Via ESXCLI

Nov 20, 2024 · attack.persistence attack.t1136 ·
Share on:

Detects user account creation on ESXi system via esxcli

Read More
AWS ElastiCache Security Group Created

Aug 12, 2024 · attack.persistence attack.t1136 attack.t1136.003 ·
Share on:

Detects when an ElastiCache security group has been created.

Read More
Default Account Usage

Aug 2, 2024 · attack.t1136 attack.t1136.001 ·
Share on:

Threat actor (APT35) created user, enabled it, set password, add to admins and remote desktop users.

Read More
NIM Pass The Hash Tooling Detection

Aug 2, 2024 · attack.t1136 ·
Share on:

Detection of NIM Tooling that Creates a Remote User (pth_createusers.exe) and Adds them to Local Admins group (pth_addadmin.exe)

Read More
Suspicious 'Admin' Local User Creation with Net Command

Sep 1, 2023 · attack.persistence attack.privilege_escalation attack.t1136.001 attack.t1136 attack.t1078 attack.t1078.003 ·
Share on:

Detects creation of a local user account using the net command with 'Admin' in the name - this technique is used by Vice Society ransomware gang to create bogus user accounts that attempt to blend in with an administrative user account naming convention.

Read More