Detect Domain Account in CrowdStrike LogScale
Adversaries may create a domain account to maintain access to victim systems. Domain accounts are managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. With sufficient privileges, the net user /add /domain command or PowerShell's New-ADUser cmdlet can be used to create domain accounts. Threat actors including GALLIUM, BlackByte, Wizard Spider, HAFNIUM, and Medusa Group have used this technique to establish persistent, credentialed access that does not require remote access tools to remain deployed.
MITRE ATT&CK
- Tactic
- Persistence
- Technique
- T1136 Create Account
- Sub-technique
- T1136.002 Domain Account
- Canonical reference
- https://attack.mitre.org/techniques/T1136/002/
LogScale Detection Query
// Branch 3–4: Process-based detection via Falcon EDR telemetry
#event_simpleName = ProcessRollup2
| FileName = /(?i)^(net|net1|dsadd|powershell|pwsh)\.exe$/
| case {
FileName = /(?i)^(net|net1|dsadd)\.exe$/ AND CommandLine = /(?i)((\/add.*\/domain|\/domain.*\/add)|dsadd\s+user)/
| DetectionBranch := "ProcessCmdLine_NetAddDomain" | SuspicionScore := 2 ;
FileName = /(?i)^(powershell|pwsh)\.exe$/ AND CommandLine = /(?i)(New-ADUser|Add-ADGroupMember|New-ADAccount)/ AND CommandLine = /(?i)(Domain Admins|Enterprise Admins|Schema Admins|Administrators|-AccountPassword|-Enabled)/
| DetectionBranch := "PowerShell_ADCmdlet" | SuspicionScore := 3 ;
* | drop
}
| table([timestamp, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName, ParentCommandLine, DetectionBranch, SuspicionScore])
union
// Branch 1–2: Audit event-based detection via Falcon Identity Protection or Windows event forwarding
#event_simpleName = UserAccountCreated
| UserIsAdmin = /0|false/i OR UserIsAdmin = *
| DomainName != "WORKGROUP" AND DomainName != ""
| DetectionBranch := "DomainAccountCreated"
| SuspicionScore := 2
| table([timestamp, ComputerName, UserName, DomainName, SubjectUserName, DetectionBranch, SuspicionScore])
union
#event_simpleName = UserAccountAddedToGroup
| GroupName = /(?i)(Domain Admins|Enterprise Admins|Schema Admins|Group Policy Creator Owners|^Administrators$)/
| DetectionBranch := "PrivilegedGroupMembership"
| SuspicionScore := 3
| table([timestamp, ComputerName, UserName, GroupName, SubjectUserName, DetectionBranch, SuspicionScore])
| sort(SuspicionScore, order=desc)Detects domain account creation and privileged group membership additions using CrowdStrike Falcon EDR telemetry. ProcessRollup2 events detect net.exe, dsadd.exe, and PowerShell AD cmdlet execution with domain account creation patterns. UserAccountCreated and UserAccountAddedToGroup events from Falcon Identity Protection cover audit-trail equivalent detection for Security Events 4720 and 4728. Results are scored by suspicion level.
Data Sources
Required Tables
False Positives & Tuning
- Endpoint management tooling (SCCM, Tanium, Ansible) invoking net.exe as part of automated device provisioning or configuration management tasks
- IT administrators executing approved PowerShell runbooks to manage AD group memberships during quarterly access reviews or role-based access control audits
- Automated identity provisioning integrations triggered by HR system events (new hire, role change) that call AD cmdlets to create accounts and assign group memberships
Other platforms for T1136.002
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Create Domain Account via Net User
Expected signal: Domain Controller Security Event ID 4720: TargetUserName=df00tech_test_acct, SubjectUserName=<executing account>, TargetDomainName=<domain>. Sysmon Event ID 1 on executing host: Image=C:\Windows\System32\net.exe, CommandLine containing 'user df00tech_test_acct' and '/add /domain'. Security Event 4688 (if command line auditing enabled) on executing host.
- Test 2Create Domain Account and Add to Domain Admins via PowerShell
Expected signal: Domain Controller Security Event 4720: account creation for df00tech_priv_test. Domain Controller Security Event 4728: MemberName=df00tech_priv_test added to TargetUserName=Domain Admins. Sysmon Event 1: powershell.exe with CommandLine containing 'New-ADUser' and 'Add-ADGroupMember'. PowerShell ScriptBlock Log Event 4104 with full command text.
- Test 3Create Domain Account via dsadd
Expected signal: Domain Controller Security Event 4720: TargetUserName=df00tech_dsadd_test. Sysmon Event 1: Image=C:\Windows\System32\dsadd.exe, CommandLine containing 'user CN=df00tech_dsadd_test'. Security Event 4688 on executing host with dsadd.exe process creation.
- Test 4Simulate Adversary Account Naming with Empire-style Pattern
Expected signal: Domain Controller Security Event 4720 with TargetUserName=svc_argus_health$ (note the $ suffix mimicking a machine or service account). Sysmon Event 1: net.exe with /add /domain. Security Event 4688. The account name pattern (svc_ prefix, $ suffix) may not match naming convention baselines and should be noted in triage.
References (10)
- https://attack.mitre.org/techniques/T1136/002/
- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4720
- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4728
- https://web.archive.org/web/20150511162820/http://windowsitpro.com/windows/netexe-reference
- https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers
- https://www.microsoft.com/en-us/security/blog/2019/12/12/gallium-targeting-global-telecom/
- https://www.mandiant.com/resources/fin12-ransomware-intrusion-actor-redefining-speed
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-058a
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1136.002/T1136.002.md
- https://learn.microsoft.com/en-us/powershell/module/activedirectory/new-aduser
Unlock Pro Content
Get the full detection package for T1136.002 including response playbook, investigation guide, and atomic red team tests.