diff --git a/atomics/Indexes/Indexes-CSV/index.csv b/atomics/Indexes/Indexes-CSV/index.csv
index 27aa2e7e..1d66b27a 100644
--- a/atomics/Indexes/Indexes-CSV/index.csv
+++ b/atomics/Indexes/Indexes-CSV/index.csv
@@ -114,6 +114,7 @@ persistence,T1136.001,Local Account,2,Create a user account on a MacOS system,01
persistence,T1136.001,Local Account,3,Create a new user in a command prompt,6657864e-0323-4206-9344-ac9cd7265a4f,command_prompt
persistence,T1136.001,Local Account,4,Create a new user in PowerShell,bc8be0ac-475c-4fbf-9b1d-9fffd77afbde,powershell
persistence,T1136.001,Local Account,5,Create a new user in Linux with `root` UID and GID.,a1040a30-d28b-4eda-bd99-bb2861a4616c,bash
+persistence,T1136.001,Local Account,6,Create a new Windows admin user,fda74566-a604-4581-a4cc-fbbe21d66559,command_prompt
persistence,T1037.002,Logon Script (Mac),1,Logon Scripts - Mac,f047c7de-a2d9-406e-a62b-12a09d9516f4,manual
persistence,T1037.001,Logon Script (Windows),1,Logon Scripts,d6042746-07d4-4c92-9ad8-e644c114a231,command_prompt
persistence,T1546.007,Netsh Helper DLL,1,Netsh Helper DLL Registration,3244697d-5a3a-4dfc-941c-550f69f91a4d,command_prompt
diff --git a/atomics/Indexes/Indexes-CSV/windows-index.csv b/atomics/Indexes/Indexes-CSV/windows-index.csv
index 94a65cf9..7656d38c 100644
--- a/atomics/Indexes/Indexes-CSV/windows-index.csv
+++ b/atomics/Indexes/Indexes-CSV/windows-index.csv
@@ -211,6 +211,7 @@ persistence,T1546.012,Image File Execution Options Injection,1,IFEO Add Debugger
persistence,T1546.012,Image File Execution Options Injection,2,IFEO Global Flags,46b1f278-c8ee-4aa5-acce-65e77b11f3c1,command_prompt
persistence,T1136.001,Local Account,3,Create a new user in a command prompt,6657864e-0323-4206-9344-ac9cd7265a4f,command_prompt
persistence,T1136.001,Local Account,4,Create a new user in PowerShell,bc8be0ac-475c-4fbf-9b1d-9fffd77afbde,powershell
+persistence,T1136.001,Local Account,6,Create a new Windows admin user,fda74566-a604-4581-a4cc-fbbe21d66559,command_prompt
persistence,T1037.001,Logon Script (Windows),1,Logon Scripts,d6042746-07d4-4c92-9ad8-e644c114a231,command_prompt
persistence,T1546.007,Netsh Helper DLL,1,Netsh Helper DLL Registration,3244697d-5a3a-4dfc-941c-550f69f91a4d,command_prompt
persistence,T1574.009,Path Interception by Unquoted Path,1,Execution of program.exe as service with unquoted service path,2770dea7-c50f-457b-84c4-c40a47460d9f,command_prompt
diff --git a/atomics/Indexes/Indexes-Markdown/index.md b/atomics/Indexes/Indexes-Markdown/index.md
index ecf68be6..a700eb14 100644
--- a/atomics/Indexes/Indexes-Markdown/index.md
+++ b/atomics/Indexes/Indexes-Markdown/index.md
@@ -253,6 +253,7 @@
- Atomic Test #3: Create a new user in a command prompt [windows]
- Atomic Test #4: Create a new user in PowerShell [windows]
- Atomic Test #5: Create a new user in Linux with `root` UID and GID. [linux]
+ - Atomic Test #6: Create a new Windows admin user [windows]
- T1078.003 Local Accounts [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)
- [T1037.002 Logon Script (Mac)](../../T1037.002/T1037.002.md)
- Atomic Test #1: Logon Scripts - Mac [macos]
diff --git a/atomics/Indexes/Indexes-Markdown/windows-index.md b/atomics/Indexes/Indexes-Markdown/windows-index.md
index b1169884..a48f1cc0 100644
--- a/atomics/Indexes/Indexes-Markdown/windows-index.md
+++ b/atomics/Indexes/Indexes-Markdown/windows-index.md
@@ -416,6 +416,7 @@
- [T1136.001 Local Account](../../T1136.001/T1136.001.md)
- Atomic Test #3: Create a new user in a command prompt [windows]
- Atomic Test #4: Create a new user in PowerShell [windows]
+ - Atomic Test #6: Create a new Windows admin user [windows]
- T1078.003 Local Accounts [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)
- [T1037.001 Logon Script (Windows)](../../T1037.001/T1037.001.md)
- Atomic Test #1: Logon Scripts [windows]
diff --git a/atomics/Indexes/index.yaml b/atomics/Indexes/index.yaml
index 9f15c0d1..614cd113 100644
--- a/atomics/Indexes/index.yaml
+++ b/atomics/Indexes/index.yaml
@@ -11955,15 +11955,39 @@ persistence:
type: String
default: BetterWithButter
executor:
- command: "useradd -g 0 -M -d /root -s /bin/bash #{username}\nif [ $(cat /etc/os-release
- | grep -i 'Name=\"ubuntu\"') ]; then echo \"#{username}:#{password}\" |
- sudo chpasswd; else echo \"#{password}\" | passwd --stdin #{username}; fi;
- \ \n"
+ command: |
+ useradd -g 0 -M -d /root -s /bin/bash #{username}
+ if [ $(cat /etc/os-release | grep -i 'Name="ubuntu"') ]; then echo "#{username}:#{password}" | sudo chpasswd; else echo "#{password}" | passwd --stdin #{username}; fi;
cleanup_command: 'userdel #{username}
'
name: bash
elevation_required: true
+ - name: Create a new Windows admin user
+ auto_generated_guid: fda74566-a604-4581-a4cc-fbbe21d66559
+ description: 'Creates a new admin user in a command prompt.
+
+'
+ supported_platforms:
+ - windows
+ input_arguments:
+ username:
+ description: Username of the user to create
+ type: String
+ default: T1136.001_Admin
+ password:
+ description: Password of the user to create
+ type: String
+ default: T1136_pass
+ executor:
+ command: |
+ net user /add "#{username}" "#{password}"
+ net localgroup administrators "#{username}" /add
+ cleanup_command: 'net user /del "#{username}" >nul 2>&1
+
+'
+ name: command_prompt
+ elevation_required: true
T1078.003:
technique:
external_references:
diff --git a/atomics/T1136.001/T1136.001.md b/atomics/T1136.001/T1136.001.md
index 653f79ec..38303054 100644
--- a/atomics/T1136.001/T1136.001.md
+++ b/atomics/T1136.001/T1136.001.md
@@ -16,6 +16,8 @@ Such accounts may be used to establish secondary credentialed access that do not
- [Atomic Test #5 - Create a new user in Linux with `root` UID and GID.](#atomic-test-5---create-a-new-user-in-linux-with-root-uid-and-gid)
+- [Atomic Test #6 - Create a new Windows admin user](#atomic-test-6---create-a-new-windows-admin-user)
+
@@ -192,4 +194,39 @@ userdel #{username}
+
+
+
+## Atomic Test #6 - Create a new Windows admin user
+Creates a new admin user in a command prompt.
+
+**Supported Platforms:** Windows
+
+
+
+
+#### Inputs:
+| Name | Description | Type | Default Value |
+|------|-------------|------|---------------|
+| username | Username of the user to create | String | T1136.001_Admin|
+| password | Password of the user to create | String | T1136_pass|
+
+
+#### Attack Commands: Run with `command_prompt`! Elevation Required (e.g. root or admin)
+
+
+```cmd
+net user /add "#{username}" "#{password}"
+net localgroup administrators "#{username}" /add
+```
+
+#### Cleanup Commands:
+```cmd
+net user /del "#{username}" >nul 2>&1
+```
+
+
+
+
+
diff --git a/atomics/used_guids.txt b/atomics/used_guids.txt
index d1b106a9..b5a40d48 100644
--- a/atomics/used_guids.txt
+++ b/atomics/used_guids.txt
@@ -553,3 +553,4 @@ a90c2f4d-6726-444e-99d2-a00cd7c20480
d696a3cb-d7a8-4976-8eb5-5af4abf2e3df
efe86d95-44c4-4509-ae42-7bfd9d1f5b3d
7382a43e-f19c-46be-8f09-5c63af7d3e2b
+fda74566-a604-4581-a4cc-fbbe21d66559