Create Local Account

Adversaries may create a local account to maintain access to a victim system. A local account is configured for use on one system or service. On Windows, an authorized process with sufficient privileges can create one with the built-in net user command. This procedure covers account creation only; use of existing accounts, group membership changes, and logon startup persistence are separate actions.