value:  Flame can create backdoor accounts with login “HelpAssistant” on domain connected systems if appropriate rights are available. ;; Fox Kitten has created a local user account with administrator privileges. ;; GoldenSpy can create new users on an infected system. ;; HiddenWasp creates a user account as a means to provide initial persistence to the compromised machine. ;; Hildegard has created a user named “monerodaemon”. ;; Leafminer used a tool called Imecab to set up a persistent remote access account on the victim machine. ;; Mis-Type may create a temporary user on the system named “Lost_{Unique Identifier}.” ;; The net user username \password commands in Net can be used to create a local account. ;; Pupy can user PowerView to execute “net user” commands and create local system accounts. ;; S-Type may create a temporary user on the system named “Lost_{Unique Identifier}” with the password “pond~!@6”{Unique Identifier}.” ;; ServHelper has created a new user and added it to the Remote Desktop Users" and "Administrators" groups. ;; ZxShell has a feature to create local user accounts.";;A known TTP of APT34 is to create local user accounts with the net command for the purpose of lateral movement. ;; BazarLoader is known to deploy CobaltStrike beacons which create local accounts in addition to domain accounts. ;; Threat actors often create local accounts to maintain presence within a network before infecting machines with ransomware such as Phobos or RagnarLocker. 
name: Create Account: Local Account