Domain Computer Account Creation via Join Rights

Creating an Active Directory computer account can provide a secondary domain identity and may map to ATT&CK T1136.002; that mapping is an analyst application of the domain-account technique to computer objects. Legitimate domain joins also create computer objects, and object creation alone does not establish remote execution or a usable interactive logon. Effective creation may come from the Add workstations to domain right and its quota, or from delegated Create Computer Objects permissions on an OU or container.