MITRE D3FENDdefensive technique

D3-LAM Local Account Monitoring

Official page ↗

Tactic: Detect

Definition

Analyzing local user accounts to detect unauthorized activity.

Related

Counters · MITRE ATT&CK (6)

T1078.003 Local Accounts sub-technique
T1087.001 Local Account sub-technique
T1136.001 Local Account sub-technique
T1136 Create Account technique
T1078 Valid Accounts technique
T1087 Account Discovery technique

Child of · MITRE D3FEND (1)

D3-UBA User Behavior Analysis defensive technique

References

https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-user-account-management Audit User Account Management
https://car.mitre.org/analytics/CAR-2016-04-004/ Reference - CAR-2016-04-004: Successful Local Account Login
https://github.com/osquery/osquery/blob/d2be385d71f401c85872f00d479df8f499164c5a/osquery/tables/system/windows/users.cpp OS Query Windows User Collection Code