T1078.003sub-technique of T1078 Valid Accounts
Local Accounts
Containers · ESXi · Linux · macOS · Network Devices · Windowsnothing on this site yetT1078.003 on attack.mitre.org
Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service. Local Accounts may also be abused to elevate privileges and harvest credentials through OS Credential Dumping.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Edge appliance or VPN compromise
A vendor advisory for a device you run at the perimeter, unexplained admin sessions on it, or an internal alert whose earliest source is the VPN range.
Web shell on a public-facing server
An unfamiliar file in a web root, a web server process spawning a shell, or outbound traffic from a machine that should only ever receive it.
Suspicious execution on an endpoint
An EDR alert, an unexplained process, or a user reporting something odd.
Cloud account compromise
Impossible travel, an unrecognised inbox rule, or a reported invoice-fraud attempt.
how MITRE says to see it
Detection of Local Account Abuse for Initial Access and Persistence
- Detects anomalous usage of local accounts to log into a system, especially accounts not typically used interactively or outside business hours.
- Detects interactive or service logins from local accounts outside expected operational context or at anomalous times.
- Detects abnormal or rare logins via local accounts through system or remote mechanisms such as SSH.
what reduces it
- M1027 Password Policies. Ensure that local administrator accounts have complex, unique passwords across all systems on the network.
- M1018 User Account Management. Enforce user account management practices for local accounts to limit access and remove inactive or unused accounts. By doing so, you reduce the attack surface available to adversaries and prevent unauthorized access to local systems.
- M1026 Privileged Account Management. Audit local accounts permission levels routinely to look for situations that could allow an adversary to gain wide access by obtaining credentials of a privileged account. Limit the usage of local administrator accounts to be used for day-to-day operations that may expose them to potential adversaries.
- M1032 Multi-factor Authentication. Enable multi-factor authentication (MFA) for local accounts to add an extra layer of protection against credential theft and misuse. MFA can be implemented using methods like mobile-based authenticators or hardware tokens, even in environments that do not rely on domain controllers or cloud services.