Loading story…
MITRE ATT&CK documents local account creation as a common persistence technique under T1136.001, describing how threat groups and malware have created or enabled accounts on compromised Windows systems to maintain access and support lateral movement. Reported activity includes use of built-in commands such as net user to add accounts, sometimes followed by placement into privileged groups, with examples ranging from generic support-style usernames to attacker-controlled administrator accounts.
Splunk published and later replaced a detection for this behavior that monitors endpoint process telemetry for net.exe or net1.exe creating local administrator accounts with the /add parameter and administrator-group keywords. The analytic, now superseded by Windows Create Local Administrator Account Via Net, is mapped to ATT&CK T1136.001 and is intended to help defenders spot suspicious account creation, while noting that legitimate IT administration can generate false positives.
Get the actors, campaigns, and ATT&CK mapping behind it.
2 events from the most recent confirmed update back to the earliest known activity.
Splunk removed the "Create local admin accounts using net exe" analytic from its Threat Research content library in version 5.2.0, stating it had been renamed and its logic updated. Splunk identified the replacement as "Windows Create Local Administrator Account Via Net."
Splunk published a detection analytic titled "Create local admin accounts using net exe" to identify attempts to create local administrator accounts via net.exe or net1.exe, mapped to MITRE ATT&CK T1136.001.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
MITRE ATT&CK documents widespread adversary use of the Windows `net localgroup` command—particularly `net localgroup administrators`—to enumerate local groups and identify accounts with local administrator privileges after compromise. The technique, tracked as **T1069.001** (*Permission Groups Discovery: Local Groups*), appears across numerous intrusion sets and malware families, including OilRig, Turla, Volt Typhoon, Tonto Team, Chimera, and HEXANE, and is also supported by offensive tooling such as BloodHound, Cobalt Strike, PoshC2, and SILENTTRINITY. Splunk has removed its legacy **Net Localgroup Discovery** analytic, which detected execution of `net localgroup` through EDR process telemetry, and replaced it with **Windows Group Discovery Via Net** (UUID `c5c8e0f3-147a-43da-bf04-4cfaec27dc44`). The retired rule had been aligned to ATT&CK **T1069.001** and was intended to surface attacker reconnaissance that can enable privilege escalation and lateral movement, underscoring continued defender focus on monitoring local group enumeration on Windows systems.
Aug 12, 2026
Attackers can maintain persistence on Windows by abusing **Winlogon** autostart mechanisms, including modification of registry values such as `HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell` and `Userinit`, as well as use of the **Winlogon Helper DLL** technique tracked by MITRE ATT&CK as `T1547.004`. By altering these settings, a malicious executable or DLL can be launched automatically during user logon, giving malware a reliable way to survive reboots and regain execution. Public technical material showed a C++ proof of concept that rewrites Winlogon registry keys to start a test payload at logon and noted that older Windows versions may also expose persistence through the `Winlogon\Notify` key. The technique requires elevated privileges, but it has been associated with real-world malware activity, including **Turla**, **Gazer**, and **Bazaar**. Defenders are advised to restrict local administrator access and monitor Winlogon-related autorun entries for unauthorized changes, including with tools such as **Sysinternals Autoruns**.
Aug 15, 2026
Blackpoint Cyber reported an intrusion at an industrial organization in which attackers deployed **PCHunter64.exe** from the unusual path `C:\PerfLogs`, alongside **AnyDesk**, **FileZilla**, **MASSCAN**, and **RDP** activity across seven endpoints. Investigators observed failed `ADMIN$` share mount attempts by two user accounts on one machine, indicating attempted lateral movement, and Blackpoint said it isolated affected systems within minutes before issuing remediation guidance. The incident underscores continued abuse of legitimate or allowlisted Windows administration and remote-access tools in operational environments. Sandbox analysis of **PCHunter64** shows the tool can go well beyond administration, including dropping signed driver components, creating Windows service registry entries such as `PCHUNTER64`, loading kernel drivers, deleting **SafeBoot** registry keys, and exhibiting anti-debugging and anti-VM behavior. The activity aligns with MITRE ATT&CK persistence techniques including **Windows Service** creation or modification (`T1543.003`) and boot or logon autostart execution (`T1547.008`), while additional indicators pointed to credential-access behavior, including an artifact consistent with **LSASS** minidump collection. Together, the references show how a dual-use utility can be weaponized for persistence, defense evasion, and deeper compromise inside Windows environments.
Jul 19, 2026