ATT&CK T1136 - SMB New Account Creation Attempt

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•3

This rule detects attempts to create new user accounts via SMB (Server Message Block) by looking for the 'NetUserAdd' function call within SMB traffic. This could indicate an attacker attempting to establish persistence or escalate privileges by creating new accounts on a target system.