T1136Persistence
Create Account
Adversaries may create an account to maintain access to victim systems. With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system. Accounts may be created on the local system or within a domain or cloud tenant. In cloud environments, adversaries may create…
CVEs33
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.13
Reports1
Detections
3 Sigma rules tagged T1136Create AccountT11363 general rules
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Create Account
33 CVEs, by priority. Each link shows its badge.- CVE-2021-34473Microsoft Exchange Server Remote Code Execution VulnerabilityMicrosoft · Exchange ServerKEVRansomwarePublic exploitCritical · 9.1T1190Exploit Public-Facing ApplicationT1053.005Scheduled Task+3 more · 9 reportsMITRE CTID mapping of the KEV entry · follow-on activity>99.9%Top 0.01%89.4priority
- CVE-2023-20198Cisco IOS XE Web UI Privilege Escalation VulnerabilityCisco · IOS XE Web UIKEVPublic exploitCritical · 10.0T1190Exploit Public-Facing ApplicationT1136Create Account2 reportsMITRE CTID mapping of the KEV entry · primary impact99.6%Top 0.05%86.1priority
- CVE-2023-34362Progress MOVEit Transfer SQL Injection VulnerabilityProgress · MOVEit TransferKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+5 more · 2 reportsMITRE CTID mapping of the KEV entry · follow-on activity99.9%Top 0.03%86.0priority
- CVE-2021-40539Zoho ManageEngine ADSelfService Plus Authentication Bypass VulnerabilityZoho · ManageEngineKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1047Windows Management Instrumentation+11 more · 1 reportMITRE CTID mapping of the KEV entry · follow-on activity99.0%Top 0.07%83.7priority
- CVE-2023-27997Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow VulnerabilityFortinet · FortiOS and FortiProxy SSL-VPNKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1574Hijack Execution Flow+1 more · 1 reportMITRE CTID mapping of the KEV entry · primary impact85.7%Top 0.28%83.7priority
- CVE-2023-35078Ivanti Endpoint Manager Mobile Authentication Bypass VulnerabilityIvanti · Endpoint Manager Mobile (EPMM)KEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1136Create Account+1 moreMITRE CTID mapping of the KEV entry · primary impact>99.9%Top 0.01%79.9priority
- CVE-2025-31161CrushFTP Authentication Bypass VulnerabilityCrushFTP · CrushFTPKEVRansomwarePublic exploitCritical · 9.8T1078Valid AccountsT1059Command and Scripting Interpreter+1 moreMITRE CTID mapping of the KEV entry · primary impact>99.9%Top 0.02%79.9priority
- CVE-2021-20021SonicWall Email Security Improper Privilege Management VulnerabilitySonicWall · SonicWall Email SecurityKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1136Create AccountAI mapping from the description · primary impact88.8%Top 0.22%79.8priority
- CVE-2023-22515Atlassian Confluence Data Center and Server Broken Access Control VulnerabilityAtlassian · Confluence Data Center and ServerKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1078Valid Accounts+3 moreMITRE CTID mapping of the KEV entry · primary impact99.2%Top 0.07%79.8priority
- CVE-2023-28252Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation VulnerabilityMicrosoft · WindowsKEVRansomwarePublic exploitHigh · 7.8T1078Valid AccountsT1059Command and Scripting Interpreter+5 moreMITRE CTID mapping of the KEV entry · follow-on activity48.9%Top 1.1%78.2priority
- CVE-2021-45467In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, an unauthenticated attacker can use %00 bytes to…AI mapping from the description · primary impact70.7%Top 0.6%70.6priority
- CVE-2018-19410Paessler PRTG Network Monitor Local File Inclusion VulnerabilityPaessler · PRTG Network MonitorKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1136Create AccountAI mapping from the description · primary impact97.9%Top 0.09%69.8priority
- CVE-2021-44077Zoho ManageEngine ServiceDesk Plus Remote Code Execution VulnerabilityZoho · ManageEngine ServiceDesk Plus (SDP) / SupportCenter PlusKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1047Windows Management Instrumentation+11 moreMITRE CTID mapping of the KEV entry · follow-on activity93.3%Top 0.16%69.8priority
- CVE-2020-10181Sumavision EMR Cross-Site Request Forgery (CSRF) VulnerabilitySumavision · Enhanced Multimedia Router (EMR)KEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1136Create AccountAI mapping from the description · primary impact14.9%Top 3.3%69.2priority
- CVE-2018-8353A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in…MITRE CTID mapping of the CVE · follow-on activity67.3%Top 0.7%24.9priority
- CVE-2018-8355A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft…MITRE CTID mapping of the CVE · follow-on activity67.9%Top 0.68%24.9priority
- CVE-2019-1118A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite…MITRE CTID mapping of the CVE · follow-on activity23.6%Top 2.2%24.6priority
- CVE-2020-16874Visual Studio Remote Code Execution VulnerabilityMicrosoft · Microsoft Visual Studio 2019 version 16.7 (includes 16.0 – 16.6)High · 7.8T1204.002Malicious FileT1574Hijack Execution Flow+5 moreMITRE CTID mapping of the CVE · follow-on activity4.3%Top 8.9%24.4priority
- CVE-2020-1569Microsoft Edge Memory Corruption VulnerabilityMITRE CTID mapping of the CVE · follow-on activity3.0%Top 13%23.6priority
- CVE-2019-3758RSA Archer, versions prior to 6.6 P2 (6.6.0.2), contain an improper authentication vulnerabilityMITRE CTID mapping of the CVE · follow-on activity1.5%Top 26%20.4priority
- CVE-2019-0609A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft…MITRE CTID mapping of the CVE · follow-on activity9.8%Top 4.4%19.8priority
- CVE-2018-8248A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle…MITRE CTID mapping of the CVE · follow-on activity21.4%Top 2.4%19.5priority
- CVE-2018-8575A remote code execution vulnerability exists in Microsoft Project software when it fails to properly handle objects in…MITRE CTID mapping of the CVE · follow-on activity19.5%Top 2.6%19.5priority
- CVE-2018-8110A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft…MITRE CTID mapping of the CVE · follow-on activity16.9%Top 2.9%19.4priority
- CVE-2018-8111A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft…MITRE CTID mapping of the CVE · follow-on activity16.9%Top 2.9%19.4priority
- CVE-2020-1495Microsoft Excel Remote Code Execution VulnerabilityMicrosoft · Microsoft SharePoint Server 2010 Service Pack 2T1566PhishingT1204.002Malicious File+6 moreMITRE CTID mapping of the CVE · follow-on activity4.2%Top 9%18.9priority
- CVE-2019-3798Escalation of Privileges in Cloud ControllerCloud Foundry · CAPI-releaseMedium · 6.0T1136Create AccountT1068Exploitation for Privilege EscalationMITRE CTID mapping of the CVE · how it is exploited1.3%Top 29%18.5priority
- CVE-2020-1109Windows Update Stack Elevation of Privilege VulnerabilityMITRE CTID mapping of the CVE · follow-on activity1.0%Top 37%18.0priority
- CVE-2020-1111Windows Clipboard Service Elevation of Privilege VulnerabilityMicrosoft · Windows 10 Version 1809High · 7.8T1136Create AccountT1068Exploitation for Privilege Escalation+3 moreMITRE CTID mapping of the CVE · follow-on activity1.0%Top 39%17.7priority
- CVE-2020-11010SQL injection in Tortoise ORMtortoise · tortoise-ormMedium · 6.3T1133External Remote ServicesT1190Exploit Public-Facing Application+5 moreMITRE CTID mapping of the CVE · follow-on activity1.0%Top 36%17.2priority
- CVE-2019-18234Equinox Control Expert all versions, is vulnerable to an SQL injection attack, which may allow an attacker to remotely…MITRE CTID mapping of the CVE · follow-on activity1.9%Top 20%15.9priority
- CVE-2020-0671An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka…MITRE CTID mapping of the CVE · follow-on activity1.4%Top 28%15.0priority
- CVE-2020-5231Opencast users with ROLE_COURSE_ADMIN can create new usersMITRE CTID mapping of the CVE · follow-on activity0.6%Top 50%13.3priority
Linked through a sub-technique
2 more- CVE-2022-47966Zoho ManageEngine Multiple Products Remote Code Execution VulnerabilityZoho · ManageEngineKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1136.001Local Account+1 more · 3 reports99.8%Top 0.04%87.6priority
- CVE-2022-21999Microsoft Windows Print Spooler Privilege Escalation VulnerabilityMicrosoft · WindowsKEVRansomwarePublic exploitHigh · 7.8T1078Valid AccountsT1059Command and Scripting Interpreter+3 more41.0%Top 1.3%78.2priority