Forensia CTI Core

About

Adversaries may create an account to maintain access to victim systems. With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system. Accounts may be created on the local system or within a domain or cloud tenant. In cloud environments, adversaries may create accounts that only have access to specific services, which can reduce the chance of detection.

Platforms: Windows, IaaS, Linux, macOS, Network Devices, Containers, SaaS, Office Suite, Identity Provider, ESXiMITRE ATT&CK ↗

Used by actors

3 known groups

G0119 Indrik Spider G1015 Scattered Spider G1045 Salt Typhoon

Software

1 malware/tools implement this

LockBit 2.0

Corpus indicators tagged with this technique

178 indicators in the corpus carry T1136.

Indicator	Type	Family	Sev	Src
cve-2025-61155	cve	ransomware	85	3
cve-2013-3307	cve	—	85	2
cve-2021-27137	cve	—	85	8
cve-2023-52271	cve	ransomware	85	3
cve-2016-5681	cve	—	85	2
cve-2016-15047	cve	—	85	4
cve-2025-34054	cve	—	85	4
cve-2025-1055	cve	ransomware	85	3
cve-2025-11837	cve	—	85	2
b82936f37648518425c7d3cf9e09eaffa41d7cdb3840f6a40287e3a108880f7b	sha256	—	80	2
6c700ca4e6d917c7aa9d964e98604a0349d9b8b4673df96a3f73a3d2d042635a	hash	—	80	2
6a69ea2ce3fea0ebfd7a32a1dfc4251bd4d7d8a4fbd44aaa47b82290d0414a9f	hash	—	80	2
d78f64551d1b31a31e5998e442f0debd458e011e05019b3951d9ddde997f8384	hash	—	80	2
78a82d93b4f580835f5823b85a3d9ee1f03a15ee6f0e01b4eac86252a7002981	hash	supply_chain	80	1
7b361a6d0d42309d09ec9000b53712b3	hash	—	80	2
0627f034c42549e2130734b5f8dbf854	hash	—	80	2
3b6cb20891bce8602ce669187754871e402a1782031ef8b032cd007e3894bc5d	hash	—	80	2
308351124c496d4f4effee65ab828506abf70385773c167ab1f32a7f030385ac	hash	—	80	2
01e3dce00ea45829bd9f6a583004976ac63973a0	hash	cryptojacking	80	1
6f9fbe29f8cc2788e2bc9d631e0eea2a8e9837076837b55838005a0e654f0a9e	hash	ransomware	80	3
0ffb4b4e430f4b69216fb9d2e082e482	hash	—	80	2
19232d0eff3ef7aee3b5d7620c72358c	hash	—	80	2
36ff9f683e870145aaf5a715bc934762	hash	—	80	2
6869f24aecd75e2144aba8dc03dc2d0f	hash	—	80	2
6f761f63642cd6329a29cfad80be50c3	hash	—	80	2
6f91d1f8f0cbaab137351936b52f7a94	hash	—	80	2
7461445fca3f9d8911148e0908d33c3b	hash	—	80	2
a3e3197e2344c51e95c063541ea22205	hash	—	80	2
dc35086ba0f5f83545c32a023a1f3be4	hash	—	80	2
eead44c0af7ddb12cece1a6125cf213bab3c22511cd59aff9d63dcfddb7d4386	hash	—	80	4

Showing the top 30 by severity of 178.