> For the complete documentation index, see [llms.txt](https://dmcxblue.gitbook.io/red-team-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://dmcxblue.gitbook.io/red-team-notes/persistence/create-account.md).

# Create Account

Adversaries with sufficient level of access may create a local system, domain, or cloud tenant account. Such accounts may be used for persistence that do not require persistent remote access tools to be deployed on the system

In cloud environments, adversaries may create accounts that only have acccess to specific services, which can reduce the chance of detection.

### Windows

The `net user` commands can be used to create a local or domain account.

### Office 365

An adversary with access to Global Admin account can create another account and assign it the Global Admin role for persistent access to the Office365 tenant.

There are various tools that have modules for creating and account with predetermined passwords such as "`joe Password1!`" from Empire or other's that use `hacker Password123` here is the command line for a simple syntax to add a user

`net user username password /add` 

This only works with the proper permissions of course such as Admin if we use a low level userwe will get an Access denied this part of persistence is usually done after some for of Privesc has been taken or a user with the required permission:

![Low-Level user](/files/-LxcYWfu21p889r048Tt)

Administrator:

![](/files/-LxcYs8xBzKhC8BG4B9Q)

![Login for hacker](/files/-LxcZ3bpJIYe40BDuNHr)

Remember to add the user to the Administrator Group or this will just be created as a Local Account with no Admin privileges

![](/files/-Lxc_b1rK5nqo3gW7b3P)

`net localgroup Administrators hacker /add`

`Powershell: Add-LocalGroupMember -Group Administrators -Member hacker`

This will ensure that the new created user is an Administrator and doesn't receive no Prompt's when running in High Privileges.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://dmcxblue.gitbook.io/red-team-notes/persistence/create-account.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.