Valid Accounts: Domain Accounts

Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.[1] Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover users, administrators, and services.[2]

Adversaries may compromise domain accounts, some with a high level of privileges, through various means such as OS Credential Dumping or password reuse, allowing access to privileged resources of the domain.

ID: T1078.002
Sub-technique of:  T1078
Platforms: Linux, Windows, macOS
Permissions Required: Administrator, User
Contributors: Jon Sternstein, Stern Security
Version: 1.2
Created: 13 March 2020
Last Modified: 19 April 2022

Procedure Examples

ID Name Description
G0016 APT29

APT29 has used valid accounts, including administrator accounts, to help facilitate lateral movement on compromised networks.[3][4][5]

G0022 APT3

APT3 leverages valid accounts after gaining credentials for use within the victim domain.[6]

G0114 Chimera

Chimera has used compromised domain accounts to gain access to the target environment.[7]

S0154 Cobalt Strike

Cobalt Strike can use known credentials to run commands and spawn processes as a domain user account.[8][9][10]

G0119 Indrik Spider

Indrik Spider has collected credentials from infected systems, including domain accounts.[11]

G0019 Naikon

Naikon has used administrator credentials for lateral movement in compromised networks.[12]

G0116 Operation Wocao

Operation Wocao has used domain credentials, including domain admin, for lateral movement and privilege escalation.[13]

S0446 Ryuk

Ryuk can use stolen domain admin accounts to move laterally within a victim domain.[14]

G0034 Sandworm Team

Sandworm Team has used stolen credentials to access administrative accounts within the domain.[15]

S0140 Shamoon

If Shamoon cannot access shares using current privileges, it attempts access using hard coded, domain-specific credentials gathered earlier in the intrusion.[16][17]

S0603 Stuxnet

Stuxnet attempts to access network resources with a domain account’s credentials.[18]

G0092 TA505

TA505 has used stolen domain admin accounts to compromise additional hosts.[19]

G0028 Threat Group-1314

Threat Group-1314 actors used compromised domain credentials for the victim's endpoint management platform, Altiris, to move laterally.[20]

G0102 Wizard Spider

Wizard Spider has used administrative accounts, including Domain Admin, to move laterally within a victim network.[21]


ID Mitigation Description
M1032 Multi-factor Authentication

Integrating multi-factor authentication (MFA) as part of organizational policy can greatly reduce the risk of an adversary gaining control of valid credentials that may be used for additional tactics such as initial access, lateral movement, and collecting information. MFA can also be used to restrict access to cloud resources and APIs.

M1026 Privileged Account Management

Audit domain account permission levels routinely to look for situations that could allow an adversary to gain wide access by obtaining credentials of a privileged account. Do not put user or admin domain accounts in the local administrator groups across systems unless they are tightly controlled and use of accounts is segmented, as this is often equivalent to having a local administrator account with the same password on all systems. Follow best practices for design and administration of an enterprise network to limit privileged account use across administrative tiers. Limit credential overlap across systems to prevent access if account credentials are obtained.

M1017 User Training

Applications may send push notifications to verify a login as a form of multi-factor authentication (MFA). Train users to only accept valid push notifications and to report suspicious push notifications.


ID Data Source Data Component
DS0028 Logon Session Logon Session Creation
Logon Session Metadata
DS0002 User Account User Account Authentication

Configure robust, consistent account activity audit policies across the enterprise and with externally accessible services.[22] Look for suspicious account behavior across systems that share accounts, either user, admin, or service accounts. Examples: one account logged into multiple systems simultaneously; multiple accounts logged into the same machine simultaneously; accounts logged in at odd times or outside of business hours. Activity may be from interactive login sessions or process ownership from accounts being used to execute binaries on a remote system as a particular account. Correlate other security systems with login information (e.g., a user has an active login session but has not entered the building or does not have VPN access).

On Linux, check logs and other artifacts created by use of domain authentication services, such as the System Security Services Daemon (sssd).[23]

Perform regular audits of domain accounts to detect accounts that may have been created by an adversary for persistence.