MITRE ATT&CKsub-technique

T1078.002 Domain Accounts

Published 2020-03-13 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Stealth, Persistence, Privilege Escalation, Initial Access
Platforms
ESXi, Linux, macOS, Windows
Version
2.0
Created
2020-03-13

Description

Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover users, administrators, and services. Adversaries may compromise domain accounts, some with a high level of privileges, through various means such as OS Credential Dumping or password reuse, allowing access to privileged resources of the domain.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1078 Valid Accounts technique

Tactic · MITRE ATT&CK (4)

Referenced by MITRE ATT&CK · mitigates (5)

  • M1032 Multi-factor Authentication mitigation
  • M1017 User Training mitigation
  • M1018 User Account Management mitigation
  • M1026 Privileged Account Management mitigation
  • M1027 Password Policies mitigation

Referenced by MITRE ATT&CK · uses (36)

  • G1059 NIMBUS MANTICORE group
  • G1057 ShinyHunters group
  • C0063 2025 Poland Wiper Attacks campaign
  • G1055 VOID MANTICORE group
  • C0059 Salesforce Data Exfiltration campaign
  • C0049 Leviathan Australian Intrusions campaign
  • C0048 Operation MidnightEclipse campaign
  • G1043 BlackByte group
  • G1040 Play group
  • G1030 Agrius group
  • C0029 Cutting Edge campaign
  • G1023 APT5 group
  • G1022 ToddyCat group
  • G1021 Cinnamon Tempest group
  • G1017 Volt Typhoon group
  • C0024 SolarWinds Compromise campaign
  • C0023 Operation Ghost campaign
  • C0014 Operation Wocao campaign
  • C0012 Operation CuckooBees campaign
  • C0002 Night Dragon campaign
  • S1024 CreepySnail software (malware)
  • G0143 Aquatic Panda group
  • G0119 Indrik Spider group
  • S0603 Stuxnet software (malware)
  • G0114 Chimera group
  • S0446 Ryuk software (malware)
  • G0102 Wizard Spider group
  • G0092 TA505 group
  • G0059 Magic Hound group
  • G0049 OilRig group
Show all 36 ›

Referenced by Compliance · mitigates (20)

  • CIS-13.5 Manage Access Control for Remote Access CIS Safeguard v8.1
  • CIS-4.7 Manage Default Accounts on Enterprise Assets and Software CIS Safeguard v8.1
  • CIS-5.2 Use Unique Passwords CIS Safeguard v8.1
  • CIS-5.3 Disable Dormant Accounts CIS Safeguard v8.1
  • CIS-5.4 Restrict Administrator Privileges to Dedicated Administrator Accounts CIS Safeguard v8.1
  • CIS-6.2 Establish an Access Revoking Process CIS Safeguard v8.1
  • CIS-6.5 Require MFA for Administrative Access CIS Safeguard v8.1
  • NIST-AC-2 Account Management NIST 800-53 control
  • NIST-AC-20 Use of External Systems NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-5 Separation of Duties NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-AC-7 Unsuccessful Logon Attempts NIST 800-53 control
  • NIST-CM-5 Access Restrictions for Change NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-IA-12 Identity Proofing NIST 800-53 control
  • NIST-IA-13 Identity Providers and Authorization Servers NIST 800-53 control
  • NIST-IA-2 Identification and Authentication (Organizational Users) NIST 800-53 control
  • NIST-IA-5 Authenticator Management NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control

References