Adduser

Overview

HackTool:Win32/Adduser (often classified as a Potentially Unwanted Program or a malicious utility) is a simple but highly effective tool used by attackers during the 'post-exploitation' phase of an attack. It is not an exploit itself, but rather a script or small executable designed to automate the creation of rogue local or domain administrator accounts, ensuring persistent, highly privileged access to the compromised system or network.

Understanding Adduser (Post-Exploitation Utilities)
To an end-user, the execution of Adduser is invisible. For a security team, the detection of an Adduser tool is a massive red flag. It indicates that an attacker has already bypassed initial defenses, successfully escalated privileges (as creating an admin account requires admin rights), and is actively establishing a permanent backdoor into the environment, independent of the original vulnerability they exploited.

Execution and Persistence Mechanics
Adduser utilities are typically deployed via a reverse shell, PsExec, or after an attacker successfully exploits a vulnerability that grants `SYSTEM` or `Administrator` access (`T1068`). The tool itself often just acts as a wrapper for native Windows commands. It executes commands like `net user [username] [password] /add` followed by `net localgroup administrators [username] /add` (`T1136.001`). In a domain environment, if executed on a Domain Controller or with Domain Admin rights, it may use `net user /domain` to create a new Domain Admin (`T1136.002`). To evade detection, attackers often name these rogue accounts deceptively, such as 'ServiceAdmin', 'BackupAgent', or mimic the names of recently departed employees.

Indicators of Compromise & Impact
The impact is total, persistent administrative compromise of the host or domain. Host-based IoCs include EDR alerts for the execution of `net.exe` or `net1.exe` with arguments containing `/add`, especially when spawned from a web shell, PowerShell, or an unusual parent process. The primary IoC is the generation of Windows Security Event ID 4720 (A user account was created) followed closely by Event ID 4732 (A member was added to a security-enabled local group).

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1059.003: Restrict execution of Windows Command Shell (cmd.exe) and block unauthorized batch scripts.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_ADDUSER {
    meta:
        description = "Detects Adduser (backdoor)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "adduser" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Adduser Activity
id: a8d729744cce939323d37f1789be0d4f
status: experimental
description: Detects generic indicators of the adduser malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*adduser*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Immediately disable (do not delete yet, for forensic purposes) any rogue accounts created by the tool.
2. Isolate the endpoint where the command was executed; if the tool was run successfully, the attacker already has SYSTEM-level access to that machine.
3. Audit all Active Directory and Local Administrator groups across the network to ensure no other unauthorized accounts have been created.
4. Conduct a full root-cause analysis to determine how the attacker gained the initial administrative privileges required to run the Adduser tool.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not assume that deleting the rogue account removes the attacker; if they have `SYSTEM` access, they likely have deployed other backdoors (like scheduled tasks or web shells).
2. Avoid ignoring alerts for `net.exe /add`; while sometimes used by legitimate IT scripts, it is one of the most common techniques used by ransomware operators and APTs to maintain access.

References & External Analysis

• Search "adduser" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: backdoor)

Explore other malware families in the same category:

• Tick
• Winnti
• Mytob
• Meterpreter
• Turla

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/adduser.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.