attack.t1136

ESXi Account Creation Via ESXCLI

May 21, 2025 · attack.persistence attack.execution attack.t1136 attack.t1059.012 ·

Detects user account creation on ESXi system via esxcli

New Kubernetes Service Account Created

May 20, 2025 · attack.persistence attack.t1136 ·

Detects creation of new Kubernetes service account, which could indicate an attacker's attempt to persist within a cluster.

AWS ElastiCache Security Group Created

Aug 12, 2024 · attack.persistence attack.t1136 attack.t1136.003 ·

Share on:

Detects when an ElastiCache security group has been created.

Suspicious 'Admin' Local User Creation with Net Command

Sep 1, 2023 · attack.persistence attack.privilege_escalation attack.t1136.001 attack.t1136 attack.t1078 attack.t1078.003 ·

Share on:

Detects creation of a local user account using the net command with 'Admin' in the name - this technique is used by Vice Society ransomware gang to create bogus user accounts that attempt to blend in with an administrative user account naming convention.