By adding a user account on each executed system, an attacker can continue to perform subsequent actions on that system. There are both advantages and disadvantages to this approach. Adding a new account on the compromised system is faster than compromising existing accounts and can allow immediate access to existing remote services such as RDP. Alternatively, adding a new account is not very stealthy and can sometimes trigger alerts on host-based intrusion-detection systems.