T1136.001 Create Account: Local Account

2 threats tracked by Spectrum Delta use this technique.

T1136.001 on MITRE ATT&CK →

• n0n credential extortion

  Hidden administrator accounts created with service-style names

  Windows Security event log account-creation events (4720)

  Seen in: Windows Security event log

• k0t edge-device campaign

  Path-traversal exploit (CVE-2025-64446) creates a rogue local administrator

  FortiWeb event logs: local account creation, admin profile assignment, trusted-host configuration changes

  Seen in: FortiGate/FortiWeb event logs