ATT&CK technique
View on MITRE ATT&CK →
T1136.002
Domain Account
Persistence
13 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| splunk | Windows ESX Admins Group Creation via Net | production | 2026-10-09 |
| elastic | User Account Creation | production | 2026-09-18 |
| elastic | dMSA Account Creation by an Unusual User | production | 2026-09-18 |
| sigma | New User Account Creation Attempt Via ADSI | experimental | 2026-08-13 |
| sigma | New User Account Creation Attempt Via ADSI in CommandLine | experimental | 2026-08-13 |
| sigma | ADCS - Certighost Ghost Machine Account Creation | experimental | 2026-07-30 |
| splunk | Windows Computer Account Changed to Domain Controller | production | 2026-05-13 |
| splunk | Windows ESX Admins Group Creation Security Event | production | 2026-05-13 |
| splunk | Windows ESX Admins Group Creation via PowerShell | production | 2026-05-13 |
| splunk | Windows Privileged Group Modification | production | 2026-05-13 |
| sigma | PSEXEC Remote Execution File Artefact | test | 2023-02-23 |
| sigma | Suspicious Windows ANONYMOUS LOGON Local Account Created | test | 2022-10-09 |
| sigma | Manipulation of User Computer or Group Security Principals Across AD | test | 2021-12-28 |