{"id":"T1078.003","name":"Local Accounts","url":"https://attack.mitre.org/techniques/T1078/003","tactics":["stealth","persistence","privilege-escalation","initial-access"],"platforms":["Containers","ESXi","Linux","macOS","Network Devices","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0407","stix_id":"x-mitre-detection-strategy--b045b89e-3095-41c3-a04d-d40075f14cd8","name":"Detection of Local Account Abuse for Initial Access and Persistence","url":"https://attack.mitre.org/detectionstrategies/DET0407","analytics":[{"id":"AN1137","stix_id":"x-mitre-analytic--9c53e92a-3659-4137-881a-f4002af9c688","name":"Analytic 1137","description":"Detects anomalous usage of local accounts to log into a system, especially accounts not typically used interactively or outside business hours.","url":"https://attack.mitre.org/detectionstrategies/DET0407#AN1137","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Security","channel":"EventCode=4624, 4648","data_component":"DC0067","data_component_name":"Logon Session Creation","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Security","channel":"EventCode=4672","data_component":"DC0088","data_component_name":"Logon Session Metadata","log_source_slug":"wineventlog-security"}],"mutable_elements":[{"field":"TimeWindow","description":"Tune for normal business hours to reduce false positives from legitimate after-hours work."},{"field":"UserContext","description":"Define list of legitimate local users for interactive access."}],"live":true,"detection_strategies":["DET0407"],"techniques":["T1078.003"]},{"id":"AN1138","stix_id":"x-mitre-analytic--269f36b6-77fa-4959-9e63-e30036c991d7","name":"Analytic 1138","description":"Detects interactive or service logins from local accounts outside expected operational context or at anomalous times.","url":"https://attack.mitre.org/detectionstrategies/DET0407#AN1138","platforms":["Linux"],"log_source_references":[{"name":"auditd:USER_LOGIN","channel":"USER_LOGIN","data_component":"DC0088","data_component_name":"Logon Session Metadata","log_source_slug":"auditd-user-login"},{"name":"linux:auth","channel":"sshd login","data_component":"DC0002","data_component_name":"User Account Authentication","log_source_slug":"linux-auth"}],"mutable_elements":[{"field":"TimeWindow","description":"Define operational hours or expected login times per host."},{"field":"HostRole","description":"Differentiate expected behavior for server vs. workstation."}],"live":true,"detection_strategies":["DET0407"],"techniques":["T1078.003"]},{"id":"AN1139","stix_id":"x-mitre-analytic--d6288db6-ff55-4720-b0ee-7aca3e65cc72","name":"Analytic 1139","description":"Detects abnormal or rare logins via local accounts through system or remote mechanisms such as SSH.","url":"https://attack.mitre.org/detectionstrategies/DET0407#AN1139","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"loginwindow or sshd","data_component":"DC0088","data_component_name":"Logon Session Metadata","log_source_slug":"macos-unifiedlog"}],"mutable_elements":[{"field":"UserContext","description":"Restrict expected local users by device owner or role."},{"field":"TimeWindow","description":"Set appropriate bounds based on endpoint usage patterns."}],"live":true,"detection_strategies":["DET0407"],"techniques":["T1078.003"]}],"live":true,"version":"1.0","techniques":["T1078.003"]}],"sigma_rules":[{"id":"0f63e1ef-1eb9-4226-9d54-8927ca08520a","title":"Admin User Remote Logon","author":"juju4","status":"test","level":"low","date":"2017-10-29","modified":"2022-10-09","description":"Detect remote login by Administrator user (depending on internal pattern).","references":["https://car.mitre.org/wiki/CAR-2016-04-005"],"logsource":{"product":"windows","service":"security"},"tags":["attack.privilege-escalation","attack.persistence","attack.lateral-movement","attack.initial-access","attack.stealth","attack.t1078.001","attack.t1078.002","attack.t1078.003","car.2016-04-005"],"path":"rules/windows/builtin/security/account_management/win_security_admin_rdp_login.yml","techniques":["T1078.001","T1078.002","T1078.003"],"cves":[]},{"id":"5d0fdb62-f225-42fb-8402-3dfe64da468a","title":"User Added To Admin Group Via DseditGroup","author":"Sohan G (D4rkCiph3r)","status":"test","level":"medium","date":"2023-08-22","modified":null,"description":"Detects attempts to create and/or add an account to the admin group, thus granting admin privileges.","references":["https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1078.003/T1078.003.md#atomic-test-5---add-a-newexisting-user-to-the-admin-group-using-dseditgroup-utility---macos","https://ss64.com/osx/dseditgroup.html"],"logsource":{"product":"macos","category":"process_creation"},"tags":["attack.persistence","attack.initial-access","attack.privilege-escalation","attack.stealth","attack.t1078.003"],"path":"rules/macos/process_creation/proc_creation_macos_dseditgroup_add_to_admin_group.yml","techniques":["T1078.003"],"cves":[]},{"id":"652c098d-dc11-4ba6-8566-c20e89042f2b","title":"User Added To Admin Group Via Sysadminctl","author":"Sohan G (D4rkCiph3r)","status":"test","level":"medium","date":"2023-03-19","modified":null,"description":"Detects attempts to create and add an account to the admin group via \"sysadminctl\"","references":["https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1078.003/T1078.003.md#atomic-test-3---create-local-account-with-admin-privileges-using-sysadminctl-utility---macos","https://ss64.com/osx/sysadminctl.html"],"logsource":{"product":"macos","category":"process_creation"},"tags":["attack.persistence","attack.initial-access","attack.privilege-escalation","attack.stealth","attack.t1078.003"],"path":"rules/macos/process_creation/proc_creation_macos_sysadminctl_add_user_to_admin_group.yml","techniques":["T1078.003"],"cves":[]},{"id":"821bcf4d-46c7-4b87-bc57-9509d3ba7c11","title":"Root Account Enable Via Dsenableroot","author":"Sohan G (D4rkCiph3r)","status":"test","level":"medium","date":"2023-08-22","modified":null,"description":"Detects attempts to enable the root account via \"dsenableroot\"","references":["https://github.com/redcanaryco/atomic-red-team/blob/b27a3cb25025161d49ac861cb216db68c46a3537/atomics/T1078.003/T1078.003.md","https://github.com/elastic/detection-rules/blob/4312d8c9583be524578a14fe6295c3370b9a9307/rules/macos/persistence_enable_root_account.toml","https://ss64.com/osx/dsenableroot.html"],"logsource":{"product":"macos","category":"process_creation"},"tags":["attack.privilege-escalation","attack.stealth","attack.t1078","attack.t1078.001","attack.t1078.003","attack.initial-access","attack.persistence"],"path":"rules/macos/process_creation/proc_creation_macos_dsenableroot_enable_root_account.yml","techniques":["T1078","T1078.001","T1078.003"],"cves":[]},{"id":"b743623c-2776-40e0-87b1-682b975d0ca5","title":"User Added To Admin Group Via Dscl","author":"Sohan G (D4rkCiph3r)","status":"test","level":"medium","date":"2023-03-19","modified":null,"description":"Detects attempts to create and add an account to the admin group via \"dscl\"","references":["https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1078.003/T1078.003.md#atomic-test-2---create-local-account-with-admin-privileges---macos","https://ss64.com/osx/dscl.html"],"logsource":{"product":"macos","category":"process_creation"},"tags":["attack.persistence","attack.initial-access","attack.privilege-escalation","attack.stealth","attack.t1078.003"],"path":"rules/macos/process_creation/proc_creation_macos_dscl_add_user_to_admin_group.yml","techniques":["T1078.003"],"cves":[]}],"kev_cves":[{"cveID":"CVE-2021-44168","state":"mapped","mapping_types":["exploitation_technique"]}],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}