T1078: Valid Accounts
| View on MITRE ATT&CK | T1078 |
|---|---|
| Tactic(s) | Persistence, Defense Evasion, Privilege Escalation, Initial Access |
| Associated CAPEC Patterns | Use of Known Domain Credentials (CAPEC-560) |
Data from MITRE ATT&CK®:
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.(Citation: volexity_0day_sophos_FW) Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
In some cases, adversaries may abuse inactive accounts: for example, those belonging to individuals who are no longer part of an organization. Using these accounts may allow the adversary to evade detection, as the original account user will not be present to identify any anomalous activity taking place on their account.(Citation: CISA MFA PrintNightmare)
The overlap of permissions for local, domain, and cloud accounts across a network of systems is of concern because the adversary may be able to pivot across accounts and systems to reach a high level of access (i.e., domain or enterprise administrator) to bypass access controls set within the enterprise.(Citation: TechNet Credential Theft)
© 2024 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.
Cyber Threat Graph Context
Explore how this ATT&CK Technique relates to the wider threat graph
Reporting on this Technique
Scattered Spider Advisory AA23-320A
This advisory from CISA outlines tactics, techniques and procedures used by the Scattered Spider threat actors, as observed by the FBI up until ...
APT40 Advisory - PRC MSS tradecraft in action
This advisory, authored by the Australian Cyber Security Centre and multiple other international cybersecurity agencies, outlines the threat posed ...
AA24-109A StopRansomware: Akira Ransomware
This is a joint #StopRansomware advisory issued by CISA and partners covering Akira ransomware attacks. According to the report, the group has ...
Fortinet Zero-Day and Custom Malware Used by Suspected Chinese Actor in Espionage Operation
This blog post by threat researchers at Mandiant outlines intrusions activity by the UNC3886 intrusion set which involved the deployment of ...
Earth Krahang Exploits Intergovernmental Trust to Launch Cross-Government Attacks
This article by researchers at Trend Micro discusses an Advanced Persistent Threat (APT) group they name Earth Krahang who have been observed ...
#StopRansomware: LockBit 3.0
This #StopRansomware Cybersecurity Advisory from CISA and partners describes the operations associated with LockBit 3.0 which operates as a ...
#StopRansomware: Play Ransomware
This is a Cybersecurity Advisory from CISA with US and international partners which outlines TTPs (tactics, techniques and procedures) and IoCs ...
GhostSec’s joint ransomware operation and evolution of their arsenal
This Threat Spotlight from Cisco Talos describes the evolution of GhostSec's ransomware operations including their work with the Stormous ...
StopRansomware: Rhysida Ransomware
This is a joint Cybersecurity Advisory by the Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), and ...
Ransomware Spotlight: Black Basta
This report from Trend Micro outlines tactics, techniques and procedures used by the Black Basta Ransomware group. According to the report, Black ...
StopRansomware: Phobos Ransomware
This is a joint Cybersecurity Advisory produced by CISA, the FBI and the Multi-State Information Sharing and Analysis Center (MS-ISAC). It ...
PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure
Following an initial advisory issued in May 2023, this advisory from CISA, NSA and partners outlines information on the broader campaign of cyber ...
Buzzing on Christmas Eve: Trigona Ransomware in 3 Hours
This report by the DFIR Report outlines a Trigona Ransomware attack. It describes how the actors went from initial access (by exposed RDP) to data ...
Russia-Aligned TAG-70 Targets European Government and Military Mail Servers in New Espionage Campaign
The Insikt Group has observed the TAG-70 using cross-site scripting (XSS) vulnerabilities to target Roundcube webmail servers in Europe. The ...
Mitigations for this technique
MITRE ATT&CK Mitigations
Multi-factor Authentication
Use two or more pieces of evidence to authenticate to a system; such as username and password in addition to a token from a physical smart card or token generator.User Account Management
Manage the creation, modification, use, and permissions associated to user accounts.Privileged Account Management
Manage the creation, modification, use, and permissions associated to privileged accounts, including SYSTEM and root.Password Policies
Set and enforce secure password policies for accounts.Application Developer Guidance
This mitigation describes any guidance or training given to developers of applications to avoid introducing security weaknesses that an adversary may be able to take advantage of.Audit
Perform audits or scans of systems, permissions, insecure software, insecure configurations, etc. to identify potential weaknesses.User Training
Train users to be aware of access or manipulation attempts by an adversary to reduce the risk of successful spearphishing, social engineering, and other techniques that involve user interaction.Filter Network Traffic
Use network appliances to filter ingress or egress traffic and perform protocol-based filtering. Configure software on endpoints to filter network traffic.Active Directory Configuration
Configure Active Directory to prevent use of certain techniques; use SID Filtering, etc.Account Use Policies
Configure features related to account use like login attempt lockouts, specific login times, etc.How to detect this technique
MITRE ATT&CK Data Components
Logon Session Creation (Logon Session)
Initial construction of a successful new user logon following an authentication attempt. (e.g. Windows EID 4624, /var/log/utmp, or /var/log/wmtp)Logon Session Metadata (Logon Session)
Contextual data about a logon session, such as username, logon type, access tokens (security context, user SIDs, logon identifiers, and logon SID), and any activity associated within itUser Account Authentication (User Account)
An attempt by a user to gain access to a network or computing resource, often by providing credentials (ex: Windows EID 4776 or /var/log/auth.log)Sigma Detections for this Technique
Azure AD Threat Intelligence
Password Provided In Command Line Of Net.EXE
Roles Are Not Being Used
Roles Assigned Outside PIM
Unfamiliar Sign-In Properties
Azure Subscription Permission Elevation Via AuditLogs
User Added to Local Administrator Group
OpenCanary - Telnet Login Attempt
AWS Suspicious SAML Activity
Account Created And Deleted Within A Close Time Frame
Cisco LDP Authentication Failures
Juniper BGP Missing MD5
PIM Alert Setting Changes To Disabled
Guest Users Invited To Tenant By Non Approved Inviters
Huawei BGP Authentication Failures
Cisco BGP Authentication Failures
Failed Logon From Public IP
Suspicious Computer Machine Password by PowerShell
Too Many Global Admins
Measurable Increase Of Successful Authentications
Roles Activation Doesn't Require MFA
Stale Accounts In A Privileged Role
Microsoft 365 - Impossible Travel Activity
New Country
Guest Account Enabled Via Sysadminctl
Increased Failed Authentications Of Any Type
OpenCanary - SSH Login Attempt
Applications That Are Using ROPC Authentication Flow
Win Susp Computer Name Containing Samtheadmin
Azure Domain Federation Settings Modified
Authentications To Important Apps Using Single Factor Authentication
External Remote RDP Logon from Public IP
Root Account Enable Via Dsenableroot
Impossible Travel
Atypical Travel
Roles Activated Too Frequently
Suspicious Browser Activity
Suspicious SignIns From A Non Registered Device
Google Cloud Kubernetes Admission Controller
Invalid PIM License
Azure Unusual Authentication Interruption
Account Tampering - Suspicious Failed Logon Reasons
Activity From Anonymous IP Address
Azure Kubernetes Admission Controller
OpenCanary - SSH New Connection Attempt
User Added to an Administrator's Azure AD Role
External Remote SMB Logon from Public IP
Suspicious Remote Logon with Explicit Credentials
Logon from a Risky IP Address
Application Using Device Code Authentication Flow
SP800-53 Controls
See which controls can help protect against this MITRE ATT&CK technique. This is based on mappings to associated SP800-53 controls produced by the MITRE Engenuity Center for Threat-Informed Defense.