CCFH-202B: CrowdStrike Certified Falcon Hunter

Question

A compromised host contains evidence that the command net user hacker password123 /add /domain was run.

Which MITRE ATT&CK technique does this correspond to?

Explanation

net user ... /add /domain creates a domain account. MITRE ATT&CK classifies this as Create Account: Domain Account (T1136.002), a Persistence tactic because the new account can maintain ongoing access to the domain.

Learn more

MITRE ATT&CK: Create Account: Domain Account (T1136.002)

CCFH-202B: CrowdStrike Certified Falcon Hunter

AstroTutor

Notes

Readiness

QuestionQ12

Community Discussion