How can a new user account provide persistence?¶
A new user account can provide persistence by creating an additional route into a system or service.
Avoid the dangerous assumption¶
The dangerous assumption is that every newly created account is automatically malicious.
Accounts are created legitimately for staff, contractors, services, testing and administration.
The investigative question is who created the account, why it was created and how it was used.
Preserve:
- the account name and identifier
- creation time
- creator account or process
- assigned roles and groups
- authentication methods
- recovery information
- first and later sign-ins
- device and source details
- actions performed
- deletion or disabling time.
A suspicious account may use a name resembling a legitimate administrator, service or employee.
Display names can mislead. Stable identifiers are more useful.
Do not assume the account creator personally used it. One compromised account may create another account that is later used by a different person or automated process.
Likewise, the presence of the account does not prove successful login.
Compare creation with later authentication, privilege changes and activity.
Where the account is disabled or deleted during containment, preserve the full record first.
The account may also exist in more than one layer, such as local device, directory, cloud tenant or application.
Also check whether the account was hidden from normal user lists, exempted from monitoring or given a misleading description. Those features may support deliberate concealment, but they should still be assessed against legitimate service-account and deployment practices.
Operational takeaway¶
Trace who or what created the account, what access it received and whether it was later used, and preserve the record before deletion or disabling.