{
  "family": "adduser",
  "sample_count": 4,
  "category": "backdoor",
  "description": "HackTool:Win32/Adduser (often classified as a Potentially Unwanted Program or a malicious utility) is a simple but highly effective tool used by attackers during the 'post-exploitation' phase of an attack. It is not an exploit itself, but rather a script or small executable designed to automate the creation of rogue local or domain administrator accounts, ensuring persistent, highly privileged access to the compromised system or network.<br><br><b>Understanding Adduser (Post-Exploitation Utilities)</b><br>To an end-user, the execution of Adduser is invisible. For a security team, the detection of an Adduser tool is a massive red flag. It indicates that an attacker has already bypassed initial defenses, successfully escalated privileges (as creating an admin account requires admin rights), and is actively establishing a permanent backdoor into the environment, independent of the original vulnerability they exploited.<br><br><b>Execution and Persistence Mechanics</b><br>Adduser utilities are typically deployed via a reverse shell, PsExec, or after an attacker successfully exploits a vulnerability that grants `SYSTEM` or `Administrator` access (`T1068`). The tool itself often just acts as a wrapper for native Windows commands. It executes commands like `net user [username] [password] /add` followed by `net localgroup administrators [username] /add` (`T1136.001`). In a domain environment, if executed on a Domain Controller or with Domain Admin rights, it may use `net user /domain` to create a new Domain Admin (`T1136.002`). To evade detection, attackers often name these rogue accounts deceptively, such as 'ServiceAdmin', 'BackupAgent', or mimic the names of recently departed employees.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total, persistent administrative compromise of the host or domain. Host-based IoCs include EDR alerts for the execution of `net.exe` or `net1.exe` with arguments containing `/add`, especially when spawned from a web shell, PowerShell, or an unusual parent process. The primary IoC is the generation of Windows Security Event ID 4720 (A user account was created) followed closely by Event ID 4732 (A member was added to a security-enabled local group).",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1136.002",
    "T1059.003",
    "T1136.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1136.001",
      "name": "Create Account: Local Account (net user /add)",
      "tactic": "Persistence"
    },
    {
      "id": "T1136.002",
      "name": "Create Account: Domain Account",
      "tactic": "Persistence"
    },
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell",
      "tactic": "Execution"
    }
  ],
  "containment_steps": [
    "Immediately disable (do not delete yet, for forensic purposes) any rogue accounts created by the tool.",
    "Isolate the endpoint where the command was executed; if the tool was run successfully, the attacker already has SYSTEM-level access to that machine.",
    "Audit all Active Directory and Local Administrator groups across the network to ensure no other unauthorized accounts have been created.",
    "Conduct a full root-cause analysis to determine how the attacker gained the initial administrative privileges required to run the Adduser tool."
  ],
  "what_to_avoid": [
    "Do not assume that deleting the rogue account removes the attacker; if they have `SYSTEM` access, they likely have deployed other backdoors (like scheduled tasks or web shells).",
    "Avoid ignoring alerts for `net.exe /add`; while sometimes used by legitimate IT scripts, it is one of the most common techniques used by ransomware operators and APTs to maintain access."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}