T1078 Valid Accounts

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. MITRE ATT&CK

1 program on CmdID 3 Sigma rules T1078 on attack.mitre.org

Its sub-techniques

MITRE ATT&CK

T1078.001Valid Accounts: Default Accounts

T1078.002Valid Accounts: Domain Accounts

T1078.003Valid Accounts: Local Accounts

Programs for it

documented by LOLBAS and GTFOBins, or named by its rules

cmdkey.exeCredentials

Sigma rules tagged with it

process creation, the highest levels first

mediumPassword Provided In Command Line Of Net.EXETim Shelton (HAWK.IO) · Windows

mediumRoot Account Enable Via DsenablerootSohan G (D4rkCiph3r) · macOS

lowGuest Account Enabled Via SysadminctlSohan G (D4rkCiph3r) · macOS

Command lines CmdID reads as it

everyday examples from tldr-pages, CC BY 4.0

List all user credentials on the page for cmdkey.exe

cmdkey /listIdentify

An example is here when CmdID’s reading of it names T1078: a Sigma rule it trips is tagged with it, or its abuse is documented as it.