Valid Accounts: Local Accounts
Other sub-techniques of Valid Accounts (4)
| ID | Name |
|---|---|
| T1078.001 | Default Accounts |
| T1078.002 | Domain Accounts |
| T1078.003 | Local Accounts |
| T1078.004 | Cloud Accounts |
Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service.
Local Accounts may also be abused to elevate privileges and harvest credentials through OS Credential Dumping. Password reuse may allow the abuse of local accounts across a set of machines on a network for the purposes of Privilege Escalation and Lateral Movement.
Procedure Examples
| Name | Description |
|---|---|
| APT32 |
APT32 has used legitimate local admin account credentials.[10] |
| Cobalt Strike |
Cobalt Strike can use known credentials to run commands and spawn processes as a local user account.[4][5] |
| Emotet |
Emotet can brute force a local admin password, then use it to facilitate lateral movement.[9] |
| FIN10 |
FIN10 has moved laterally using the Local Administrator account.[12] |
| NotPetya |
NotPetya can use valid credentials with PsExec or |
| Stolen Pencil |
Stolen Pencil has a tool to add a Windows admin account in order to allow them to ensure continued access via RDP. [11] |
| Tropic Trooper |
Tropic Trooper has used known administrator account credentials to execute the backdoor directly.[13] |
| Umbreon |
Umbreon creates valid local users to provide access to the system.[6] |
Mitigations
| Mitigation | Description |
|---|---|
| Password Policies |
Ensure that local administrator accounts have complex, unique passwords across all systems on the network. |
| Privileged Account Management |
Audit local accounts permission levels routinely to look for situations that could allow an adversary to gain wide access by obtaining credentials of a privileged account. [1] [2] These audits should check if new local accounts are created that have not be authorized. Implementing LAPS may help prevent reuse of local administrator credentials across a domain.[3] |
Detection
Perform regular audits of local system accounts to detect accounts that may have been created by an adversary for persistence. Look for suspicious account behavior, such as accounts logged in at odd times or outside of business hours.
References
- Microsoft. (2016, April 15). Attractive Accounts for Credential Theft. Retrieved June 3, 2016.
- Microsoft. (2016, April 16). Implementing Least-Privilege Administrative Models. Retrieved June 3, 2016.
- Margosis, A.. (2018, December 10). Remote Use of Local Accounts: LAPS Changes Everything. Retrieved March 13, 2020.
- Strategic Cyber LLC. (2017, March 14). Cobalt Strike Manual. Retrieved May 24, 2017.
- Mudge, R. (2017, May 23). Cobalt Strike 3.8 – Who’s Your Daddy?. Retrieved June 4, 2019.
- Fernando Mercês. (2016, September 5). Pokémon-themed Umbreon Linux Rootkit Hits x86, ARM Systems. Retrieved March 5, 2018.
- Chiu, A. (2016, June 27). New Ransomware Variant "Nyetya" Compromises Systems Worldwide. Retrieved March 26, 2019.
- US-CERT. (2017, July 1). Alert (TA17-181A): Petya Ransomware. Retrieved March 15, 2019.
- Smith, A.. (2017, December 22). Protect your network from Emotet Trojan with Malwarebytes Endpoint Security. Retrieved January 17, 2019.
- Carr, N.. (2017, May 14). Cyber Espionage is Alive and Well: APT32 and the Threat to Global Corporations. Retrieved June 18, 2017.
- ASERT team. (2018, December 5). STOLEN PENCIL Campaign Targets Academia. Retrieved February 5, 2019.
- FireEye iSIGHT Intelligence. (2017, June 16). FIN10: Anatomy of a Cyber Extortion Operation. Retrieved June 25, 2017.
- Chen, J.. (2020, May 12). Tropic Trooper’s Back: USBferry Attack Targets Air gapped Environments. Retrieved May 20, 2020.