Establish Accounts is the creation of new user or service accounts on a system or in a directory service. Attackers use it to maintain access and blend in with normal administration, so defenders should alert on new accounts, review privilege grants, and verify that account creation follows approved change control.
What Establish Accounts Means in Security Operations
Establishing accounts is the creation of new user or service accounts in a system or directory service. In defensive terms, it is a normal administrative activity that becomes security-relevant because it changes who or what can authenticate, inherit privileges, and persist in the environment.
Account creation is not dangerous by itself, but it is a high-value control point because attackers frequently use it to create durable access that looks like routine administration. That makes the event important for inventory, approval, and review workflows, especially where privileged or non-human accounts are involved.
Why Establish Accounts Matters to Access Control
New accounts expand the trusted population inside an environment. If they are created without approved ownership, purpose, or expiry, they can become a long-lived foothold that bypasses normal onboarding and offboarding discipline.
The security significance is usually not the creation event alone, but the access it enables afterward. A newly created account may inherit default group membership, cached administrative trust, application access, or service permissions that were never intended for that subject. That is why account creation and privilege assignment should be treated as one control sequence rather than separate administrative tasks.
When account creation is legitimate, the event should still be observable and attributable. When it is suspicious, the key questions are whether the account has a real business owner, whether it matches an approved request, and whether its permissions are proportionate to its stated role.
How Defenders Validate Account Creation
Detection starts with knowing what accounts exist, who owns them, and why they were created. That means comparing directory records, host-level accounts, identity platform logs, and provisioning records so that unauthorized creation is not hidden by fragmentation.
Review should focus on three signals: unexpected new principals, unusual privilege grants attached soon after creation, and account names that mimic standard service or administrative patterns. Correlating the creation event with change tickets and access approval records helps distinguish planned administration from stealthy persistence.
For externally managed environments, account creation should also be checked against vendor, platform, and change-management evidence. If a service account appears outside the normal provisioning path, the organisation should verify whether it was created by automation, by an approved operator, or by an intruder abusing administrative access.
What Happens After an Account Is Established
Once an account exists, the next risk is how it is used. Attackers may log in immediately, add credentials, assign roles, or create companion accounts to preserve access after the original entry point is discovered. In practice, the creation event is often the beginning of persistence rather than the end of the incident.
That is why defenders should review post-creation activity for privilege escalation, anomalous logon patterns, and changes to authentication material. If the account was created during a compromise, the surrounding response should consider whether sessions, keys, tokens, or linked service credentials were also exposed.
The cleanest recovery action is to establish whether the account is legitimate, necessary, and correctly scoped. If it is not, remove it and investigate every change made from the point of creation onward.
Risk and Threat Considerations
Account establishment is attractive to attackers because it creates persistence that can blend into ordinary administration. A maliciously created account may survive password resets, session termination, or endpoint cleanup if defenders do not look specifically for unauthorized principals and privilege changes.
Failure mechanism: An attacker uses existing administrative reach, compromised credentials, or automation paths to create a new account, then assigns access that makes the account appear routine while preserving control.
Impact: The environment can retain hidden access, allow privilege escalation, and prolong compromise even after the original intrusion path is closed.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Account creation and subsequent access rely on controlled credential lifecycle. |
| AC-2 — Account Management | Directly governs creation, assignment, review, and removal of system accounts. | |
| AU-2 — Event Logging | Account creation needs auditable records to detect unauthorized provisioning and privilege changes. | |
| Recommendation — Manage account credentials so newly established accounts cannot be abused with unmanaged authenticators. Require approved provisioning, periodic review, and timely disablement for every account. Log account creation and privilege changes so suspicious provisioning is visible for review. | ||
| CIS Controls v8 | CIS-5 — Account Management | Covers managing accounts and access to reduce unauthorized or stale identities. |
| Recommendation — Inventory, approve, and periodically validate all accounts, including service accounts. | ||
| MITRE ATT&CK | T1136 — Create Account | This technique describes adversaries creating accounts to maintain access and blend in. |
| Recommendation — Map suspicious provisioning activity to T1136 and alert on new accounts created outside change control. | ||
Practitioner Guidance
Why practitioners should care: Account creation is a governance event, not just an admin task. Every new account should have a clear owner, purpose, and approval trail so that provisioning does not become an untracked persistence mechanism.
What to watch for: Pay close attention to accounts created outside standard workflows, especially those that receive privileges quickly, resemble service identities, or appear during periods of incident response or infrastructure change.
Practitioner takeaway: Treat account establishment and privilege assignment as a single reviewable control, because the security outcome depends on both the creation event and what the new account is allowed to do.