# T1078.003 - Local Accounts
## [Description from ATT&CK](https://attack.mitre.org/techniques/T1078/003)
<blockquote>Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service.

Local Accounts may also be abused to elevate privileges and harvest credentials through [OS Credential Dumping](https://attack.mitre.org/techniques/T1003). Password reuse may allow the abuse of local accounts across a set of machines on a network for the purposes of Privilege Escalation and Lateral Movement. </blockquote>

## Atomic Tests

- [Atomic Test #1 - Create local account with admin privileges](#atomic-test-1---create-local-account-with-admin-privileges)


<br/>

## Atomic Test #1 - Create local account with admin privileges
After execution the new account will be active and added to the Administrators group

**Supported Platforms:** Windows


**auto_generated_guid:** a524ce99-86de-4db6-b4f9-e08f35a47a15






#### Attack Commands: Run with `command_prompt`!  Elevation Required (e.g. root or admin) 


```cmd
net user art-test /add
net user art-test Password123!
net localgroup administrators art-test /add
```

#### Cleanup Commands:
```cmd
net localgroup administrators art-test /delete >nul 2>&1
net user art-test /delete >nul 2>&1
```





<br/>
