MITRE ATT&CKsub-technique

T1078.003 Local Accounts

Published 2020-03-13 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Stealth, Persistence, Privilege Escalation, Initial Access
Platforms
Containers, ESXi, Linux, macOS, Network Devices, Windows
Version
2.0
Created
2020-03-13

Description

Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service. Local Accounts may also be abused to elevate privileges and harvest credentials through OS Credential Dumping. Password reuse may allow the abuse of local accounts across a set of machines on a network for the purposes of Privilege Escalation and Lateral Movement.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1078 Valid Accounts technique

Tactic · MITRE ATT&CK (4)

Referenced by MITRE ATT&CK · mitigates (4)

  • M1032 Multi-factor Authentication mitigation
  • M1018 User Account Management mitigation
  • M1026 Privileged Account Management mitigation
  • M1027 Password Policies mitigation

Referenced by MITRE ATT&CK · uses (24)

  • G1059 NIMBUS MANTICORE group
  • C0064 AI-Assisted Breach of Mexico's Government Infrastructure campaign
  • C0062 Anthropic AI-orchestrated Campaign campaign
  • G1047 Velvet Ant group
  • S1202 LockBit 3.0 software (malware)
  • C0049 Leviathan Australian Intrusions campaign
  • G1041 Sea Turtle group
  • G1040 Play group
  • C0024 SolarWinds Compromise campaign
  • C0014 Operation Wocao campaign
  • G0125 HAFNIUM group
  • G0094 Kimsuky group
  • S0368 NotPetya software (malware)
  • S0367 Emotet software (malware)
  • G0081 Tropic Trooper group
  • G0082 APT38 group
  • S0221 Umbreon software (malware)
  • G0056 PROMETHIUM group
  • G0050 APT32 group
  • G0051 FIN10 group
  • S0154 Cobalt Strike software (malware)
  • G0010 Turla group
  • G0016 APT29 group
  • G0046 FIN7 group

Referenced by Compliance · mitigates (26)

  • CIS-13.5 Manage Access Control for Remote Access CIS Safeguard v8.1
  • CIS-4.7 Manage Default Accounts on Enterprise Assets and Software CIS Safeguard v8.1
  • CIS-5.2 Use Unique Passwords CIS Safeguard v8.1
  • CIS-5.3 Disable Dormant Accounts CIS Safeguard v8.1
  • CIS-5.4 Restrict Administrator Privileges to Dedicated Administrator Accounts CIS Safeguard v8.1
  • CIS-6.2 Establish an Access Revoking Process CIS Safeguard v8.1
  • CIS-6.5 Require MFA for Administrative Access CIS Safeguard v8.1
  • NIST-AC-2 Account Management NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-5 Separation of Duties NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-CA-7 Continuous Monitoring NIST 800-53 control
  • NIST-CM-5 Access Restrictions for Change NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-IA-12 Identity Proofing NIST 800-53 control
  • NIST-IA-2 Identification and Authentication (Organizational Users) NIST 800-53 control
  • NIST-SA-10 Developer Configuration Management NIST 800-53 control
  • NIST-SA-11 Developer Testing and Evaluation NIST 800-53 control
  • NIST-SA-15 Development Process, Standards, and Tools NIST 800-53 control
  • NIST-SA-16 Developer-provided Training NIST 800-53 control
  • NIST-SA-17 Developer Security and Privacy Architecture and Design NIST 800-53 control
  • NIST-SA-3 System Development Life Cycle NIST 800-53 control
  • NIST-SA-4 Acquisition Process NIST 800-53 control
  • NIST-SA-8 Security and Privacy Engineering Principles NIST 800-53 control
  • NIST-SC-28 Protection of Information at Rest NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control