| ID | Name |
|---|---|
| T1078.001 | Default Accounts |
| T1078.002 | Domain Accounts |
| T1078.003 | Local Accounts |
| T1078.004 | Cloud Accounts |
Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.[1] Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover users, administrators, and services.[2]
Adversaries may compromise domain accounts, some with a high level of privileges, through various means such as OS Credential Dumping or password reuse, allowing access to privileged resources of the domain.
| ID | Name | Description |
|---|---|---|
| G1030 | Agrius |
Agrius attempted to acquire valid credentials for victim environments through various means to enable follow-on lateral movement.[3] |
| G0022 | APT3 |
APT3 leverages valid accounts after gaining credentials for use within the victim domain.[4] |
| G1023 | APT5 |
APT5 has used legitimate account credentials to move laterally through compromised environments.[5] |
| G0143 | Aquatic Panda |
Aquatic Panda used multiple mechanisms to capture valid user accounts for victim domains to enable lateral movement and access to additional hosts in victim environments.[6] |
| G0114 | Chimera |
Chimera has used compromised domain accounts to gain access to the target environment.[7] |
| G1021 | Cinnamon Tempest |
Cinnamon Tempest has obtained highly privileged credentials such as domain administrator in order to deploy malware.[8] |
| S0154 | Cobalt Strike |
Cobalt Strike can use known credentials to run commands and spawn processes as a domain user account.[9][10][11] |
| S1024 | CreepySnail |
CreepySnail can use stolen credentials to authenticate on target networks.[12] |
| C0029 | Cutting Edge |
During Cutting Edge, threat actors used compromised VPN accounts for lateral movement on targeted networks.[13] |
| G0119 | Indrik Spider |
Indrik Spider has collected credentials from infected systems, including domain accounts.[14] |
| G0059 | Magic Hound |
Magic Hound has used domain administrator accounts after dumping LSASS process memory.[15] |
| G0019 | Naikon |
Naikon has used administrator credentials for lateral movement in compromised networks.[16] |
| C0002 | Night Dragon |
During Night Dragon, threat actors used domain accounts to gain further access to victim systems.[17] |
| C0012 | Operation CuckooBees |
During Operation CuckooBees, the threat actors used compromised domain administrator credentials as part of their lateral movement.[18] |
| C0023 | Operation Ghost |
For Operation Ghost, APT29 used stolen administrator credentials for lateral movement on compromised networks.[19] |
| C0014 | Operation Wocao |
During Operation Wocao, threat actors used domain credentials, including domain admin, for lateral movement and privilege escalation.[20] |
| G1040 | Play | |
| S0446 | Ryuk |
Ryuk can use stolen domain admin accounts to move laterally within a victim domain.[22] |
| G0034 | Sandworm Team |
Sandworm Team has used stolen credentials to access administrative accounts within the domain.[23][24] |
| S0140 | Shamoon |
If Shamoon cannot access shares using current privileges, it attempts access using hard coded, domain-specific credentials gathered earlier in the intrusion.[25][26] |
| C0024 | SolarWinds Compromise |
During the SolarWinds Compromise, APT29 used domain administrators' accounts to help facilitate lateral movement on compromised networks.[27] |
| S0603 | Stuxnet |
Stuxnet attempts to access network resources with a domain account’s credentials.[28] |
| G0092 | TA505 |
TA505 has used stolen domain admin accounts to compromise additional hosts.[29] |
| G0028 | Threat Group-1314 |
Threat Group-1314 actors used compromised domain credentials for the victim's endpoint management platform, Altiris, to move laterally.[30] |
| G1022 | ToddyCat |
ToddyCat has used compromised domain admin credentials to mount local network shares.[31] |
| G1017 | Volt Typhoon |
Volt Typhoon has used compromised domain accounts to authenticate to devices on compromised networks.[32][33][34] |
| G0102 | Wizard Spider |
Wizard Spider has used administrative accounts, including Domain Admin, to move laterally within a victim network.[35] |
| ID | Mitigation | Description |
|---|---|---|
| M1032 | Multi-factor Authentication |
Integrating multi-factor authentication (MFA) as part of organizational policy can greatly reduce the risk of an adversary gaining control of valid credentials that may be used for additional tactics such as initial access, lateral movement, and collecting information. MFA can also be used to restrict access to cloud resources and APIs. |
| M1027 | Password Policies |
Implement and enforce strong password policies for domain accounts to ensure passwords are complex, unique, and regularly rotated. This reduces the likelihood of password guessing, credential stuffing, and other attack methods that rely on weak or static credentials. |
| M1026 | Privileged Account Management |
Audit domain account permission levels routinely to look for situations that could allow an adversary to gain wide access by obtaining credentials of a privileged account. Do not put user or admin domain accounts in the local administrator groups across systems unless they are tightly controlled and use of accounts is segmented, as this is often equivalent to having a local administrator account with the same password on all systems. Follow best practices for design and administration of an enterprise network to limit privileged account use across administrative tiers. Limit credential overlap across systems to prevent access if account credentials are obtained. |
| M1018 | User Account Management |
Regularly review and manage domain accounts to ensure that only active, necessary accounts exist. Remove or disable inactive and unnecessary accounts to reduce the risk of adversaries abusing these accounts to gain unauthorized access or move laterally within the network. |
| M1017 | User Training |
Applications may send push notifications to verify a login as a form of multi-factor authentication (MFA). Train users to only accept valid push notifications and to report suspicious push notifications. |
| ID | Data Source | Data Component | Detects |
|---|---|---|---|
| DS0028 | Logon Session | Logon Session Creation |
Monitor for suspicious account behavior across systems that share accounts, either user, admin, or service accounts. Examples: one account logged into multiple systems simultaneously; multiple accounts logged into the same machine simultaneously; accounts logged in at odd times or outside of business hours. Activity may be from interactive login sessions or process ownership from accounts being used to execute binaries on a remote system as a particular account. A remote desktop logon, through Remote Desktop Protocol, may be typical of a system administrator or IT support, but only from select workstations. Monitoring remote desktop logons and comparing to known/approved originating systems can detect lateral movement of an adversary. Multiple users logged into a single machine at the same time, or even within the same hour, do not typically occur in networks we have observed.Logon events are Windows Event Code 4624 for Windows Vista and above, 518 for pre-Vista. Logoff events are 4634 for Windows Vista and above, 538 for pre-Vista. Logon types 2, 3, 9 and 10 are of interest. For more details see the Logon Types table on Microsoft’s Audit Logon Events page. Analytic 1 - Remote Desktop Logon
|
| Logon Session Metadata |
Correlate other security systems with login information (e.g., a user has an active login session but has not entered the building or does not have VPN access). |
||
| DS0002 | User Account | User Account Authentication |
Monitor for an attempt by a user to gain access to a network or computing resource, often by the use of domain authentication services, such as the System Security Services Daemon (sssd) on Linux Note:
|