User Account Management

Alert ID: user_management MITRE ATT&CK: T1136 – Create Account · T1098 – Account Manipulation

---

Severity / Criticality

Level	Condition
Info	Standard user creation or deletion
High	Privilege escalation/demotion, or creation of a new administrator

---

Why is it considered malicious?

• Unauthorized administrator creation: possible backdoor for persistent access.
• Privilege escalation: enables lateral movement or full site control.
• Mass user deletion: possible cover-up or sabotage attempt.
• Unusual role changes: clear sign of possible compromise.

Caution

Attackers often create apparently “legitimate” users to maintain hidden access to the system.

---

When does the alert trigger?

• User creation: any new user registration or creation (Info).
• Administrator creation: new user with the administrator role (High).
• User deletion: any deleted account.
• Role change: privilege escalation or demotion.
• Role-weight analysis:

Role	Weight
Administrator	10
Editor	7
Author	5
Contributor	3
Subscriber	1

---

Technical Indicators (IOCs)

Type	Pattern	Description
log_pattern	SELECT * FROM wp_users WHERE user_registered > DATE_SUB(NOW(), INTERVAL 1 DAY)	Recently created-user detection
log_pattern	wp_capabilities LIKE '%administrator%'	Search for administrator accounts
behavior	admin2, wpupdate, wpengine, backup, support	Suspicious usernames
behavior	@temp-mail, @guerrillamail	Temporary or disposable email addresses

---

Common false positives

• Legitimate creation by authorized administrators.
• Membership or e-commerce plugins creating users automatically.
• Bulk imports from external tools.

Tip

Always verify time, source IP, and business context before dismissing an alert.

---

Investigation steps

1. Verify legitimacy: check whether the creator was authorized and whether the event occurred during normal hours.

2. Analyze the new user:

   wp user get [user_id] --fields=ID,user_login,user_email,roles

3. Search for related activity: more user creation, plugin installation, or theme changes.

4. Review all existing administrators:

   wp user list --role=administrator

---

Recommended mitigations

Immediate

Danger

• Suspend the suspicious user immediately.
• Audit all accounts with administrative privileges.
• Review the new user’s activity logs.
• Confirm with the team whether the action was authorized.

Preventive

Tip

• Implement dual approval for administrator creation.
• Maintain a detailed audit trail.
• Enable email notifications for role changes.
• Apply the principle of least privilege.
• Review users and permissions regularly.

---

References

• MITRE ATT&CK T1136 – Create Account
• MITRE ATT&CK T1098 – Account Manipulation
• CIS Controls – Account Management