attack_technique: T1136.002
display_name: 'Create Account: Domain Account'
atomic_tests:
- name: Create a new Windows domain admin user
  auto_generated_guid: fcec2963-9951-4173-9bfa-98d8b7834e62
  description: |
    Creates a new domain admin user in a command prompt.
  supported_platforms:
  - windows
  input_arguments:
    username:
      description: Username of the user to create
      type: String
      default: T1136.002_Admin
    password:
      description: Password of the user to create
      type: String
      default: T1136_pass123!
    group:
      description: Domain administrator group to which add the user to
      type: String
      default: Domain Admins
  executor:
    command: |
      net user "#{username}" "#{password}" /add /domain
      net group "#{group}" "#{username}" /add /domain
    cleanup_command: |
      net user "#{username}" >nul 2>&1 /del /domain
    name: command_prompt
    elevation_required: false  # Requires a user to be a Domain Admin!
- name: Create a new account similar to ANONYMOUS LOGON
  auto_generated_guid: dc7726d2-8ccb-4cc6-af22-0d5afb53a548
  description: |
    Create a new account similar to ANONYMOUS LOGON in a command prompt.
  supported_platforms:
  - windows
  input_arguments:
    username:
      description: Username of the user to create
      type: String
      default: ANONYMOUS  LOGON
    password:
      description: Password of the user to create
      type: String
      default: T1136_pass123!
  executor:
    command: |
      net user "#{username}" "#{password}" /add /domain
    cleanup_command: |
      net user "#{username}" >nul 2>&1 /del /domain
    name: command_prompt
    elevation_required: false  # Requires a user to be a Domain Admin!
- name: Create a new Domain Account using PowerShell
  auto_generated_guid: 5a3497a4-1568-4663-b12a-d4a5ed70c7d7
  description: |
    Creates a new Domain User using the credentials of the Current User
  supported_platforms:
  - windows
  input_arguments:
    username:
      description: "Name of the Account to be created"
      type: String
      default: T1136.002_Admin
    password:
      description: "Password of the Account to be created"
      type: String
      default: T1136_pass123!
  executor:
    command: |
      $SamAccountName = '#{username}'
      $AccountPassword = ConvertTo-SecureString '#{password}' -AsPlainText -Force
      Add-Type -AssemblyName System.DirectoryServices.AccountManagement
      $Context = New-Object -TypeName System.DirectoryServices.AccountManagement.PrincipalContext -ArgumentList ([System.DirectoryServices.AccountManagement.ContextType]::Domain)
      $User = New-Object -TypeName System.DirectoryServices.AccountManagement.UserPrincipal -ArgumentList ($Context)
      $User.SamAccountName = $SamAccountName
      $TempCred = New-Object System.Management.Automation.PSCredential('a', $AccountPassword)
      $User.SetPassword($TempCred.GetNetworkCredential().Password)
      $User.Enabled = $True
      $User.PasswordNotRequired = $False
      $User.DisplayName = $SamAccountName
      $User.Save()
      $User
    cleanup_command: |
      cmd /c "net user #{username} /del >nul 2>&1"
    name: powershell
    elevation_required: false  # Requires a user to be a Domain Admin!
