Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

Valid Accounts: Локальные учетные записи

Other sub-techniques of Valid Accounts (4)

ID	Название
.001	Учетные записи по умолчанию
.002	Доменные учетные записи
.003	Локальные учетные записи
.004	Облачные учетные записи

Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service. Local Accounts may also be abused to elevate privileges and harvest credentials through OS Credential Dumping. Password reuse may allow the abuse of local accounts across a set of machines on a network for the purposes of Privilege Escalation and Lateral Movement.

ID: T1078.003

Относится к технике: T1078

Тактика(-и): Defense Evasion, Initial Access, Persistence, Privilege Escalation

Платформы: Containers, Linux, macOS, Network, Windows

Требуемые разрешения: Administrator, User

Источники данных: Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication

Версия: 1.4

Дата создания: 13 Mar 2020

Последнее изменение: 15 Oct 2024

Название	Описание
Примеры процедур
APT29	APT29 has used compromised local accounts to access victims' networks.(Citation: CrowdStrike StellarParticle January 2022)
Operation Wocao	Operation Wocao has used local account credentials found during the intrusion for lateral movement and privilege escalation.(Citation: FoxIT Wocao December 2019)
Kimsuky	Kimsuky has used a tool called GREASE to add a Windows admin account in order to allow them continued access via RDP.(Citation: Netscout Stolen Pencil Dec 2018)
Cobalt Strike	Cobalt Strike can use known credentials to run commands and spawn processes as a local user account.(Citation: cobaltstrike manual)(Citation: CobaltStrike Daddy May 2017)
Emotet	Emotet can brute force a local admin password, then use it to facilitate lateral movement.(Citation: Malwarebytes Emotet Dec 2017)
Stolen Pencil	Stolen Pencil has a tool to add a Windows admin account in order to allow them to ensure continued access via RDP. (Citation: Netscout Stolen Pencil Dec 2018)
Cobalt Strike	Cobalt Strike can use known credentials to run commands and spawn processes as a local user account.(Citation: cobaltstrike manual)(Citation: CobaltStrike Daddy May 2017)
PROMETHIUM	PROMETHIUM has created admin accounts on a compromised host.(Citation: Bitdefender StrongPity June 2020)
FIN10	FIN10 has moved laterally using the Local Administrator account.(Citation: FireEye FIN10 June 2017)
Play	Play has used valid local accounts to gain initial access.(Citation: Trend Micro Ransomware Spotlight Play July 2023)
APT32	APT32 has used legitimate local admin account credentials.(Citation: FireEye APT32 May 2017)
Tropic Trooper	Tropic Trooper has used known administrator account credentials to execute the backdoor directly.(Citation: TrendMicro Tropic Trooper May 2020)
HAFNIUM	HAFNIUM has used the NT AUTHORITY\SYSTEM account to create files on Exchange servers.(Citation: FireEye Exchange Zero Days March 2021)
FIN7	FIN7 has used compromised credentials for access as SYSTEM on Exchange servers.(Citation: Microsoft Ransomware as a Service)
	During the SolarWinds Compromise, APT29 used compromised local accounts to access victims' networks.(Citation: CrowdStrike StellarParticle January 2022)
APT29	APT29 targets dormant or inactive user accounts, accounts belonging to individuals no longer at the organization but whose accounts remain on the system, for access and persistence.(Citation: NCSC et al APT29 2024)
NotPetya	NotPetya can use valid credentials with PsExec or `wmic` to spread itself to remote systems.(Citation: Talos Nyetya June 2017)(Citation: US-CERT NotPetya 2017)
Umbreon	Umbreon creates valid local users to provide access to the system.(Citation: Umbreon Trend Micro)
	During Operation Wocao, threat actors used local account credentials found during the intrusion for lateral movement and privilege escalation.(Citation: FoxIT Wocao December 2019)
Turla	Turla has abused local accounts that have the same password across the victim’s network.(Citation: ESET Crutch December 2020)

Контрмера	Описание
Контрмеры
Privileged Account Management	Manage the creation, modification, use, and permissions associated to privileged accounts, including SYSTEM and root.
Multi-factor Authentication	Use two or more pieces of evidence to authenticate to a system; such as username and password in addition to a token from a physical smart card or token generator.
Password Policies	Set and enforce secure password policies for accounts.
User Account Management	Manage the creation, modification, use, and permissions associated to user accounts.

Обнаружение

Perform regular audits of local system accounts to detect accounts that may have been created by an adversary for persistence. Look for suspicious account behavior, such as accounts logged in at odd times or outside of business hours.

Ссылки

Связанные риски

Ничего не найдено

Каталоги

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.