Cross-source coverage
T1078 / ATT&CK
Valid Accounts
720 rules · 717 families across 10 sources.
Showing deprecated rules · back to the default
From MITRE ATT&CK 19.2
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
In some cases, adversaries may abuse inactive accounts: for example, those belonging to individuals who are no longer part of an organization. Using these accounts may allow the adversary to evade detection, as the original account user will not be present to identify any anomalous activity taking place on their account.
The overlap of permissions for local, domain, and cloud accounts across a network of systems is of concern because the adversary may be able to pivot across accounts and systems to reach a high level of access (i.e., domain or enterprise administrator) to bypass access controls set within the enterprise.
- Tactics
- Stealth · Persistence · Privilege Escalation · Initial Access
- Platforms
- Containers · ESXi · IaaS · Identity Provider · Linux · macOS · Network Devices · Office Suite · SaaS · Windows
- Telemetry
-
WinEventLog:SecurityWinEventLog:Sysmonauditd:SYSCALLNSM:Connectionsmacos:unifiedlogsaas:oktakubernetes:audit
How MITRE says to detect it DET0560
Detection of Valid Account Abuse Across Platforms
Windows Analytic 1543
Detection of compromised or misused valid accounts via anomalous logon patterns, abnormal logon types, and inconsistent geographic or time-based activity across Windows endpoints.
WinEventLog:SecurityEventCode=4624WinEventLog:SecurityEventCode=4776, 4625WinEventLog:SysmonEventCode=1
Linux Analytic 1544
Detection of valid account misuse through SSH logins, sudo/su abuse, and service account anomalies outside expected patterns.
auditd:SYSCALLexecveNSM:Connectionssshd or PAM logins
macOS Analytic 1545
Detection of interactive and remote logins by service accounts or users at unusual times, with unexpected child process activity.
macos:unifiedlogloginwindow, sshdmacos:unifiedlogexec logs
Identity Provider Analytic 1546
Detection of valid account abuse in IdP logs via geographic anomalies, impossible travel, risky sign-ins, and multiple MFA attempts or failures.
saas:oktaSign-in logs / audit events
Containers Analytic 1547
Detection of containerized service accounts or compromised kubeconfigs being used for cluster access from unexpected nodes or IPs.
kubernetes:auditauthentication.k8s.io
Sub-techniques with coverage
Counted in the 720 above — a rule tagged a sub-technique covers this technique too.
elastic/detection-rules
201 rules| Detection | Severity | Format |
|---|---|---|
| Entra ID Protection Admin Confirmed Compromise | Critical | Elastic TOML |
| AdminSDHolder Backdoor | High | Elastic TOML |
| AdminSDHolder SDProp Exclusion Added | High | Elastic TOML |
| Auditd Login from Forbidden Location | High | Elastic TOML |
| AWS AssumeRoleWithWebIdentity from Kubernetes SA and External ASN | High | Elastic TOML |
| AWS Bedrock AgentCore Execution Role Used Outside Its Runtime | High | Elastic TOML |
| AWS Bedrock API Key Phantom User Activity Outside Bedrock | High | Elastic TOML |
| AWS Bedrock Foundation Model Enumeration Followed by Invocation via Long-Term Key | High | Elastic TOML |
| AWS CloudShell Environment Created | High | Elastic TOML |
| AWS Credentials Used from GitHub Actions and Non-CI/CD Infrastructure | High | Elastic TOML |
+ 191 more from elastic/detection-rules → showing the 10 highest-severity
SigmaHQ/sigma
107 rules| Detection | Severity | Format |
|---|---|---|
| Win Susp Computer Name Containing Samtheadmin | Critical | Sigma |
| Account Created And Deleted Within A Close Time Frame | High | Sigma |
| Activity From Anonymous IP Address | High | Sigma |
| Application AppID Uri Configuration Changes | High | Sigma |
| Application URI Configuration Changes | High | Sigma |
| Atypical Travel | High | Sigma |
| AWS IAM S3Browser LoginProfile Creation | High | Sigma |
| AWS IAM S3Browser Templated S3 Bucket Policy Creation | High | Sigma |
| AWS IAM S3Browser User or AccessKey Creation | High | Sigma |
| Azure AD Threat Intelligence | High | Sigma |
+ 97 more from SigmaHQ/sigma → showing the 10 highest-severity
Azure/Azure-Sentinel
106 rules| Detection | Severity | Format |
|---|---|---|
| Addition of a Temporary Access Pass to a Privileged Account | High | KQL |
| AdminSDHolder Modifications | High | KQL |
| Changes to PIM Settings | High | KQL |
| URL Added to Application from Unknown Domain | High | KQL |
| User login from different countries within 3 hours (Uses Authentication Normalization) | High | KQL |
| Anomalous login followed by Teams action | Medium | KQL |
| Anomaly Sign In Event from an IP | Medium | KQL |
| Application ID URI Changed | Medium | KQL |
| Application Redirect URL Update | Medium | KQL |
| Authentication Attempt from New Country | Medium | KQL |
+ 96 more from Azure/Azure-Sentinel → showing the 10 highest-severity
Wazuh Core Ruleset
89 rules · 88 families| Detection | Severity | Format |
|---|---|---|
| MS Graph message: A user's credentials were compromised or stolen. This is a true positive alert. | Critical | Wazuh XML |
| User: \ logged using Remote Desktop Connection (RDP) from loopback address, possible exploit over reverse tunneling using stolen credentials. · win.eventdata.logonType = 10, win.eventdata.ipAddress = ::1|127\.0\.0\.1 | Critical | Wazuh XML |
| by a success. | High | Wazuh XML |
| System user successfully logged to the system. | High | Wazuh XML |
| Netscreen firewall: Successfull admin login 2 variants | Medium | Wazuh XML |
| Netscreen firewall: Successfull admin login 2 variants | Medium | Wazuh XML |
| Office 365: Added user | Medium | Wazuh XML |
| Office 365: Add member to role | Medium | Wazuh XML |
| Office 365: Updated user | Medium | Wazuh XML |
| osCommerce file manager login.php bypass attempt. | Medium | Wazuh XML |
+ 79 more from Wazuh Core Ruleset → showing the 10 highest-severity
panther-labs/panther-analysis
80 rules| Detection | Severity | Format |
|---|---|---|
| AWS GuardDuty Critical Severity Finding | Critical | Panther Python |
| Kubernetes System Role Modified or Deleted | Critical | Panther Python |
| Okta Login Without Push | Critical | Panther Python |
| Potential Compromised Okta Credentials | Critical | Panther Python |
| Slack Primary Owner Transferred | Critical | Panther Python |
| A Login from Outside the Corporate Office | High | Panther Python |
| AWS Backdoor Administrative IAM Role Created | High | Panther Python |
| AWS Compromised IAM Key Quarantine | High | Panther Python |
| AWS IMDS Credential Usage Outside Expected Services | High | Panther Python |
| Azure High-Risk Sign-In | High | Panther Python |
+ 70 more from panther-labs/panther-analysis → showing the 10 highest-severity
splunk/security_content
73 rules| Detection | Severity | Format |
|---|---|---|
| ASL AWS Create Policy Version to allow all resources | Undefined | SPL |
| ASL AWS SAML Update identity provider | Undefined | SPL |
| AWS Bedrock Invoke Model Access Denied | Undefined | SPL |
| AWS Create Policy Version to allow all resources | Undefined | SPL |
| AWS SAML Update identity provider | Undefined | SPL |
| AWS SetDefaultPolicyVersion | Undefined | SPL |
| AWS Successful Single-Factor Authentication | Undefined | SPL |
| Azure AD Authentication Failed During MFA Challenge | Undefined | SPL |
| Azure AD Multiple AppIDs and UserAgents Authentication Spike | Undefined | SPL |
| Azure AD Multiple Failed MFA Requests For User | Undefined | SPL |
+ 63 more from splunk/security_content → showing the 10 highest-severity
chronicle/detection-rules
36 rules| Detection | Severity | Format |
|---|---|---|
| aws_api_call_outside_of_organization | High | YARA-L |
| aws_iam_administrator_access_policy_attached | High | YARA-L |
| gcp_identity_low_and_medium_severity_alert_escalation | High | YARA-L |
| gcp_workload_identity_pool_disabled_or_deleted | High | YARA-L |
| google_workspace_saml_idp_configuration_change | High | YARA-L |
| o365_admin_login_activity_to_uncommon_mscloud_apps | High | YARA-L |
| onelogin_super_user_privileges_assigned | High | YARA-L |
| aws_saml_identity_provider_changes | Medium | YARA-L |
| aws_successful_login_after_multiple_failed_attempts | Medium | YARA-L |
| aws_user_creates_permanent_access_key | Medium | YARA-L |
+ 26 more from chronicle/detection-rules → showing the 10 highest-severity
socfortress/Wazuh-Rules
18 rules · 17 families| Detection | Severity | Format |
|---|---|---|
| Local account creation detected with password hash (useradd) | High | Wazuh XML |
| Password hash generation using openssl (passwd -1) detected — possible account creation preparation | High | Wazuh XML |
| Potential User Login Via Pass the Hash Detected. | High | Wazuh XML |
| Sysmon - Event 1: Process creation · Add User to Administrators Group (T1078.003) | High | Wazuh XML |
| Sysmon - Event 1: Process creation · Create Local User (net user) (T1078.003) | High | Wazuh XML |
| Sysmon - Event 1: Process creation · Guest Account Activated (T1078.003) | High | Wazuh XML |
| Sysmon - Event 1: Process creation · Guest Added to Administrators (T1078.003) | High | Wazuh XML |
| Sysmon - Event 1: Process creation · PowerShell WinPwn Credential Dump (T1078.003) | High | Wazuh XML |
| Sysmon - Event 1: Process creation · RDP Access Enabled via Registry (T1078.003) | High | Wazuh XML |
| operation. · office_365.Operation = AuthorizeCustomTag | Low | Wazuh XML |
+ 8 more from socfortress/Wazuh-Rules → showing the 10 highest-severity
Bert-JanP/Hunting-Queries-Detection-Rules
8 rules| Detection | Severity | Format |
|---|---|---|
| CA Application SignIn Failures | Undefined | KQL |
| CA User SignIn Failures | Undefined | KQL |
| Cloud Persistence Activities by User At Risk | Undefined | KQL |
| MITRE ATT&CK Mapping | Undefined | KQL |
| Multiple Sensitive Group Additions From Commandline | Undefined | KQL |
| New Authentication App Detected | Undefined | KQL |
| Successful sign-in from suspicious user agent | Undefined | KQL |
| User added to sensitive group | Undefined | KQL |
Emerging Threats Open
2 rules| Detection | Severity | Format |
|---|---|---|
| ET WEB_SPECIFIC_APPS Fortra FileCatalyst Workflow Insecure HSQLDB Default Credentials | Critical | Suricata |
| ET WEB_SPECIFIC_APPS Cisco Smart Licensing Utility API Hardcoded Admin Credentials (CVE-2024-20439) | High | Suricata |