Adversaries may create a local account to maintain access to victim systems. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service. 

For example, with a sufficient level of access, the Windows <code>net user /add</code> command can be used to create a local account. On macOS systems the <code>dscl -create</code> command can be used to create a local account. Local accounts may also be added to network devices, often via common [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as <code>username</code>, or to Kubernetes clusters using the `kubectl` utility.(Citation: cisco_username_cmd)(Citation: Kubernetes Service Accounts Security)

Such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
Local Account
source_name: mitre-attack  url: https://attack.mitre.org/techniques/T1136/001  external_id: T1136.001     source_name: cisco_username_cmd  description: Cisco. (2023, March 6). username - Cisco IOS Security Command Reference: Commands S to Z. Retrieved July 13, 2022.  url: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/security/s1/sec-s1-cr-book/sec-cr-t2.html#wp1047035630     source_name: Kubernetes Service Accounts Security  description: Kubernetes. (n.d.). Service Accounts. Retrieved July 14, 2023.  url: https://kubernetes.io/docs/concepts/security/service-accounts/     source_name: Microsoft User Creation Event  description: Lich, B., Miroshnikov, A. (2017, April 5). 4720(S): A user account was created. Retrieved June 30, 2017.  url: https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4720     