Valid Accounts: Local Accounts

ID: T1078.003
Tactics: TA0001 Initial Access, TA0003 Persistence, TA0004 Privilege Escalation, TA0005 Stealth
Sub-technique of: T1078 Valid Accounts
Platforms: Containers, ESXi, Linux, macOS, Network Devices, Windows
Data sources: Logon Session Creation, Logon Session Metadata, User Account Authentication
Source: attack.mitre.org
MITRE last modified: 12 May 2026

Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service.

Local Accounts may also be abused to elevate privileges and harvest credentials through OS Credential Dumping. Password reuse may allow the abuse of local accounts across a set of machines on a network for the purposes of Privilege Escalation and Lateral Movement.

Detection

DET0407 Detection of Local Account Abuse for Initial Access and Persistence
Data components: Logon Session Creation, Logon Session Metadata, User Account Authentication

Mitigations (4)

M1018 User Account Management

Enforce user account management practices for local accounts to limit access and remove inactive or unused accounts. By doing so, you reduce the attack surface available to adversaries and prevent unauthorized access to local systems.

M1026 Privileged Account Management

Audit local accounts permission levels routinely to look for situations that could allow an adversary to gain wide access by obtaining credentials of a privileged account. ^[1] ^[2] Limit the usage of local administrator accounts to be used for day-to-day operations that may expose them to potential adversaries.

For example, audit the use of service accounts in Kubernetes, and avoid automatically granting them access to the Kubernetes API if this is not required.^[3] Implementing LAPS may also help prevent reuse of local administrator credentials across a domain.^[4]

M1027 Password Policies

Ensure that local administrator accounts have complex, unique passwords across all systems on the network.

M1032 Multi-factor Authentication

Enable multi-factor authentication (MFA) for local accounts to add an extra layer of protection against credential theft and misuse. MFA can be implemented using methods like mobile-based authenticators or hardware tokens, even in environments that do not rely on domain controllers or cloud services. This additional security measure can help reduce the risk of adversaries gaining unauthorized access to local systems and resources.

Groups (14)

Software (5)

References

TechNet Credential Theft
TechNet Least Privilege
Kubernetes Service Accounts
Microsoft Remote Use of Local