MITRE ATT&CK - Техника Доменные учетные записи

Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

Наш канал

Valid Accounts: Доменные учетные записи

Other sub-techniques of Valid Accounts (4)

ID	Название
.001	Учетные записи по умолчанию
.002	Доменные учетные записи
.003	Локальные учетные записи
.004	Облачные учетные записи

Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.(Citation: TechNet Credential Theft) Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover users, administrators, and services.(Citation: Microsoft AD Accounts) Adversaries may compromise domain accounts, some with a high level of privileges, through various means such as OS Credential Dumping or password reuse, allowing access to privileged resources of the domain.

ID: T1078.002

Относится к технике: T1078

Тактика(-и): Defense Evasion, Initial Access, Persistence, Privilege Escalation

Платформы: Linux, macOS, Windows

Требуемые разрешения: Administrator, User

Источники данных: Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication

Версия: 1.2

Дата создания: 13 Mar 2020

Последнее изменение: 19 Apr 2022

Название	Описание
Примеры процедур
CreepySnail	CreepySnail can use stolen credentials to authenticate on target networks.(Citation: Microsoft POLONIUM June 2022)
	During Night Dragon, threat actors used domain accounts to gain further access to victim systems.(Citation: McAfee Night Dragon)
Cobalt Strike	Cobalt Strike can use known credentials to run commands and spawn processes as a domain user account.(Citation: cobaltstrike manual)(Citation: CobaltStrike Daddy May 2017)(Citation: Cobalt Strike Manual 4.3 November 2020)
Naikon	Naikon has used administrator credentials for lateral movement in compromised networks.(Citation: Bitdefender Naikon April 2021)
	During Operation CuckooBees, the threat actors used compromised domain administrator credentials as part of their lateral movement.(Citation: Cybereason OperationCuckooBees May 2022)
Wizard Spider	Wizard Spider has used administrative accounts, including Domain Admin, to move laterally within a victim network.(Citation: FireEye KEGTAP SINGLEMALT October 2020)
Sandworm Team	Sandworm Team has used stolen credentials to access administrative accounts within the domain.(Citation: US District Court Indictment GRU Unit 74455 October 2020)
APT29	APT29 has used valid accounts, including administrator accounts, to help facilitate lateral movement on compromised networks.(Citation: ESET Dukes October 2019)(Citation: NCSC APT29 July 2020)(Citation: CrowdStrike StellarParticle January 2022)
Ryuk	Ryuk can use stolen domain admin accounts to move laterally within a victim domain.(Citation: ANSSI RYUK RANSOMWARE)
Shamoon	If Shamoon cannot access shares using current privileges, it attempts access using hard coded, domain-specific credentials gathered earlier in the intrusion.(Citation: FireEye Shamoon Nov 2016)(Citation: Unit 42 Shamoon3 2018)
Indrik Spider	Indrik Spider has collected credentials from infected systems, including domain accounts.(Citation: Crowdstrike Indrik November 2018)
APT3	APT3 leverages valid accounts after gaining credentials for use within the victim domain.(Citation: Symantec Buckeye)
Chimera	Chimera has used compromised domain accounts to gain access to the target environment.(Citation: NCC Group Chimera January 2021)
	During Operation Wocao, threat actors used domain credentials, including domain admin, for lateral movement and privilege escalation.(Citation: FoxIT Wocao December 2019)
Cobalt Strike	Cobalt Strike can use known credentials to run commands and spawn processes as a domain user account.(Citation: cobaltstrike manual)(Citation: CobaltStrike Daddy May 2017)
Operation Wocao	Operation Wocao has used domain credentials, including domain admin, for lateral movement and privilege escalation.(Citation: FoxIT Wocao December 2019)
TA505	TA505 has used stolen domain admin accounts to compromise additional hosts.(Citation: IBM TA505 April 2020)
Threat Group-1314	Threat Group-1314 actors used compromised domain credentials for the victim's endpoint management platform, Altiris, to move laterally.(Citation: Dell TG-1314)
Stuxnet	Stuxnet attempts to access network resources with a domain account’s credentials.(Citation: Symantec W.32 Stuxnet Dossier)

Контрмера	Описание
Контрмеры
Multi-factor Authentication	Use two or more pieces of evidence to authenticate to a system; such as username and password in addition to a token from a physical smart card or token generator.
Privileged Account Management	Manage the creation, modification, use, and permissions associated to privileged accounts, including SYSTEM and root.
User Training	Train users to be aware of access or manipulation attempts by an adversary to reduce the risk of successful spearphishing, social engineering, and other techniques that involve user interaction.

Обнаружение

Configure robust, consistent account activity audit policies across the enterprise and with externally accessible services.(Citation: TechNet Audit Policy) Look for suspicious account behavior across systems that share accounts, either user, admin, or service accounts. Examples: one account logged into multiple systems simultaneously; multiple accounts logged into the same machine simultaneously; accounts logged in at odd times or outside of business hours. Activity may be from interactive login sessions or process ownership from accounts being used to execute binaries on a remote system as a particular account. Correlate other security systems with login information (e.g., a user has an active login session but has not entered the building or does not have VPN access). On Linux, check logs and other artifacts created by use of domain authentication services, such as the System Security Services Daemon (sssd).(Citation: Ubuntu SSSD Docs) Perform regular audits of domain accounts to detect accounts that may have been created by an adversary for persistence.

Ссылки

Связанные риски

Риск	Связи
Несанкционированное сетевое подключение к ОС из локальной сети из-за возможности входа на ПК с использованием учетной записи любого доменного пользователя в доменных службах Active Directory НСД

Каталоги

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.