Local Account
Adversaries may create a local account to maintain access to victim systems. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service. 

For example, with a sufficient level of access, the Windows <code>net user /add</code> command can be used to create a local account. On macOS systems the <code>dscl -create</code> command can be used to create a local account. Local accounts may also be added to network devices, often via common [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as <code>username</code>, or to Kubernetes clusters using the `kubectl` utility.(Citation: cisco_username_cmd)(Citation: Kubernetes Service Accounts Security)

Such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
source_name: mitre-attack  url: https://attack.mitre.org/techniques/T1136/001  external_id: T1136.001     source_name: cisco_username_cmd  description: Cisco. (2023, March 6). username - Cisco IOS Security Command Reference: Commands S to Z. Retrieved July 13, 2022.  url: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/security/s1/sec-s1-cr-book/sec-cr-t2.html#wp1047035630     source_name: Kubernetes Service Accounts Security  description: Kubernetes. (n.d.). Service Accounts. Retrieved July 14, 2023.  url: https://kubernetes.io/docs/concepts/security/service-accounts/     source_name: Microsoft User Creation Event  description: Lich, B., Miroshnikov, A. (2017, April 5). 4720(S): A user account was created. Retrieved June 30, 2017.  url: https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4720     