Atomic Red T1136.001

Invoke-AtomicTest T1136.001

Executes the local account creation atomic test (T1136.001) with Atomic Red Team, validating detection of account creation by the attacker.

Run it in the purple team lab when you want to validate account creation detection: the T1136.001 atomic creates a local account (net user /add) and the team verifies what was detected — Event 4720 (account created), Sysmon Event 1 (net.exe), SIEM rules. It's the validation of account creation detection: the attacker's persistence and alternate access. In purple teaming, the atomic validates account rules and the result feeds the matrix.

Do not run it in production: account creation is a real change on the test host — the lab is the place and the account is removed at the end (cleanup). The noise is planned. And note: the atomic validates the local variant (net user) — domain creation (PowerShell, AD) has other atomics; coverage is validated per variant. Detection of Event 4720 and the process (net.exe) are the validated layers; without them, the attacker's account is created without a trace. The test account (recognizable name) is removed in cleanup.