aol.pm

Local Account

Subtechnique · ATTACK:enterprise:T1136.001

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:enterprise:T1136.001",
  "title": "Local Account",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1136/001",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--635cbe30-392d-4e27-978e-66774357c762",
  "external_id": "T1136.001",
  "domain": "enterprise",
  "created": "2020-01-28T13:50:22.506Z",
  "modified": "2026-05-12T15:12:00.636Z",
  "version": "1.5",
  "aliases": [

  ],
  "tactics": [
    "persistence"
  ],
  "source_references": [
    {
      "source_name": "cisco_username_cmd",
      "url": "https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/security/s1/sec-s1-cr-book/sec-cr-t2.html#wp1047035630"
    },
    {
      "source_name": "Cyber Security News",
      "url": "https://cybersecuritynews.com/superblack-actors-exploiting-two-fortinet-vulnerabilities/"
    },
    {
      "source_name": "Kubernetes Service Accounts Security",
      "url": "https://kubernetes.io/docs/concepts/security/service-accounts/"
    },
    {
      "source_name": "Microsoft User Creation Event",
      "url": "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4720"
    }
  ]
}

Explicit source assertions (35)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1136.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0038b0b8-f51c-4fd1-8b04-2fd7ebd1d61d

Mandiant FIN12 Oct 2021

ATTACK:enterprise:G1023 → uses → ATTACK:enterprise:T1136.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0782e7d8-3df6-4eb4-99a9-3d3a74c7752c

Mandiant Pulse Secure Update May 2021

ATTACK:enterprise:S0394 → uses → ATTACK:enterprise:T1136.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--08d9bd35-4d07-42f0-b462-c9c8b5a9dbab

Intezer HiddenWasp Map 2019

ATTACK:enterprise:S0493 → uses → ATTACK:enterprise:T1136.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--172e2d4d-5739-40d3-ae0d-4bf76890e79f

Trustwave GoldenSpy June 2020

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1136.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--187c8a97-3ba1-476e-8377-592adb8e70a3

Github PowerShell Empire

ATTACK:enterprise:M1032 → mitigates → ATTACK:enterprise:T1136.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1e4070de-5bae-4900-a3a8-907190f34dd4

ATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1136.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--23df34a9-9705-4efa-9f8f-90f4bcb1a310

US-CERT TA18-074A

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1136.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--25e9205c-3f27-4f93-81ea-b4bc1e3325ac

Intezer TeamTNT September 2020

ATTACK:enterprise:G0117 → uses → ATTACK:enterprise:T1136.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--26ce5847-3f53-4736-92c6-7a82e17cd884

ClearSky Pay2Kitten December 2020

ATTACK:enterprise:S0649 → uses → ATTACK:enterprise:T1136.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--327d7bd3-ab28-4016-8d5e-b4364a413566

FireEye SMOKEDHAM June 2021

ATTACK:enterprise:C0062 → uses → ATTACK:enterprise:T1136.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--39cf444d-5b03-46f8-8de7-bdc8b92407a0

Anthropic AI Orchestrated Campaign NOV 2025

ATTACK:enterprise:G0096 → uses → ATTACK:enterprise:T1136.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--410d7922-e288-49ea-9607-27942505a416

FireEye APT41 Aug 2019

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1136.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4248d8aa-eec4-4fd3-9707-ca1ed85bf5c5

Sygnia Elephant Beetle Jan 2022

ATTACK:enterprise:S0143 → uses → ATTACK:enterprise:T1136.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--57e6eba5-cb21-4a0d-b524-4981f49037b1

Kaspersky Flame · Kaspersky Flame Functionality

ATTACK:enterprise:S0382 → uses → ATTACK:enterprise:T1136.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5db107fe-7b8d-4093-a551-492eb4a72ed9

Proofpoint TA505 Jan 2019

ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:T1136.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6852e4b7-b1de-417a-b8db-370d04d8c072

KISA Operation Muzabi

ATTACK:enterprise:S0192 → uses → ATTACK:enterprise:T1136.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6c7965c9-6ea5-4693-889d-25c1c47b2698

GitHub Pupy

ATTACK:enterprise:S0085 → uses → ATTACK:enterprise:T1136.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6d819560-bdfb-4e0a-bf56-fddcba60cdb5

Cylance Dust Storm

ATTACK:enterprise:S0039 → uses → ATTACK:enterprise:T1136.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7185fe1c-1565-4175-bc7e-539ff704f4cb

Savill 1999

ATTACK:enterprise:S1111 → uses → ATTACK:enterprise:T1136.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7a4e646f-17a6-449e-a1fe-2a7784acd884

Ensilo Darkgate 2018

ATTACK:enterprise:S0084 → uses → ATTACK:enterprise:T1136.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7e55e411-230e-4d1a-a780-d07784ed2cd6

Cylance Dust Storm

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1136.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8d0f3fa6-1e32-492e-8d34-f9f38a8e56ba

CISA_AA25-239ASaltTyphoon_Sept2025

ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1136.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a26397b4-7959-40d7-953c-c2afec8a1f80

DFIR Report APT35 ProxyShell March 2022 · Microsoft Iranian Threat Actor Trends November 2021

ATTACK:enterprise:T1136.001 → subtechnique-of → ATTACK:enterprise:T1136

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a2788f0f-70d5-4872-97f8-ce72d5a172b9

ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1136.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a386e2aa-b5bf-435f-8d5a-2ad0b9a9da22

Mandiant_UNC1549TTPsTools_Nov2025

ATTACK:enterprise:S0030 → uses → ATTACK:enterprise:T1136.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a7fc5d9b-7010-4bab-9e77-3b8e449a98bd

FireEye CARBANAK June 2017

ATTACK:enterprise:G0119 → uses → ATTACK:enterprise:T1136.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b21266cc-1c7a-4ec5-9f15-5acc771a6560

Mandiant_UNC2165

ATTACK:enterprise:M1026 → mitigates → ATTACK:enterprise:T1136.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b94f3018-c2f2-473e-96ee-23889cb018bb

ATTACK:enterprise:G0077 → uses → ATTACK:enterprise:T1136.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c6ee4856-1782-4430-af7f-4d71e84c9b97

Symantec Leafminer July 2018

ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1136.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c6f11dfe-dd59-4310-9619-ed42ee48d736

BitDefender Chafer May 2020

ATTACK:enterprise:S0601 → uses → ATTACK:enterprise:T1136.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c832fb66-57f5-40cb-94aa-ad788a4aad39

Unit 42 Hildegard Malware

ATTACK:enterprise:S0412 → uses → ATTACK:enterprise:T1136.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c9ad232a-2276-40b2-bf56-490fc6357cca

Talos ZxShell Oct 2014

ATTACK:enterprise:G1034 → uses → ATTACK:enterprise:T1136.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cc9ea395-767a-42df-9618-c685478a4a3d

Symantec Daggerfly 2023

ATTACK:enterprise:G0022 → uses → ATTACK:enterprise:T1136.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f0b3c919-bf39-4bc9-9488-5f30d5407c54

aptsim

ATTACK:enterprise:S0274 → uses → ATTACK:enterprise:T1136.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fe99ee01-a049-4867-bf3b-27d05461b0b3

Symantec Calisto July 2018

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.