Techniques › T1078 › T1078.002
T1078.002 Domain Accounts
stealth · persistence · privilege escalation · initial access — ESXi, Linux, macOS, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
4
analytics
7
Sigma rules tagged attack.t1078.002
0
KEV CVEs mapped here
<p>Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover users, administrators, and services.</p><p>Adversaries may compromise domain accounts, some with a high level of privileges, through various means such as OS Credential Dumping or password reuse, allowing access to privileged resources of the domain.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0210 Abuse of Domain Accounts v1.0
AN0590 WindowsDetection of suspicious logon behavior using valid domain accounts across multiple hosts, off-hours, or simultaneous sessions from geographically distant locations.Tunable:
TimeWindowUserContextLogonTypeAN0591 LinuxUse of domain accounts via sssd or winbind for logon activity outside of typical patterns, especially on sensitive systems or with lateral movement tools.Tunable:HostnameScopeAccountDomainAN0592 macOSDomain logins using network accounts or mobile accounts via Open Directory or Active Directory plugins, especially outside business hours or on atypical endpoints.macos:unifiedloglog show --predicate 'eventMessage contains "Authentication"'→ DC0002 User Account AuthenticationTunable:UserLocationLogonMethodAN0593 ESXiLogin to vSphere or ESXi hosts using domain accounts, especially those associated with vpxuser or unexpected group memberships.Tunable:AccountTypeLoginInterface
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1078.002
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-05-24 · logsource: product=windows category=ps_script · 02122374-b74e-495c-b285-9e4da973f3d6
Detects the creation of a dMSA service account using the New-ADServiceAccount cmdlet in certain OUs.
The fact that the cmdlet is used to create a dMSASvc account in a specific OU is highly suspicious.
It is a pattern trying to exploit the BadSuccessor privilege escalation vulnerability in Windows Server 2025.
On top of that, if the user that is creating the dMSASvc account is not a legitimate administrator or does not have the necessary permissions,
it is a strong signal of an attempted or successful abuse of the BaDSuccessor vulnerability for privilege escalation within the Windows Server 2025 Active Directory environment.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-05-24 · logsource: product=windows category=process_creation · 0ea8db81-2ff6-4525-9448-33bbe7effc13
Detects the creation of a dMSASvc account using the New-ADServiceAccount cmdlet in certain OUs.
The fact that the Cmdlet is used to create a dMSASvc account in a specific OU is highly suspicious.
It is a pattern trying to exploit the BadSuccessor privilege escalation vulnerability in Windows Server 2025.
On top of that, if the user that is creating the dMSASvc account is not a legitimate administrator or does not have the necessary permissions,
it is a strong signal of an attempted or successful abuse of the BaDSuccessor vulnerability for privilege escalation within the Windows Server 2025 Active Directory environment.
Author: juju4
· 2017-10-29 (modified 2022-10-09) · logsource: product=windows service=security · 0f63e1ef-1eb9-4226-9d54-8927ca08520a
Detect remote login by Administrator user (depending on internal pattern).
Author: jamesc-grafana
· 2024-07-11 · logsource: product=aws service=cloudtrail · 352a918a-34d8-4882-8470-44830c507aa3
Detects when an instance identity has taken an action that isn't inside SSM.
This can indicate that a compromised EC2 instance is being used as a pivot point.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-05-24 · logsource: product=windows service=security · 6c9eb492-e477-4df9-b0f4-571fc9db29cd
Detects modifications to the msDS-ManagedAccountPrecededByLink attribute, which may indicate an attempted or successful abuse of the BaD-Successor msDS-DelegatedManagedServiceAccount (DMSA) vulnerability.
The DMSA is a new object class introduced in Windows Server 2025 that allows administrators to delegate the management of service accounts to other users or groups.
Changes to this attribute by suspicious accounts or outside of normal administrative workflows are a strong signal of an attempted or successful abuse.
If it is indeed modified by an account that is not typically responsible for such changes, it could indicate an attempt to exploit the BaD-Successor vulnerability for privilege escalation within the Windows Server 2025 Active Directory environment.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-05-24 · logsource: product=windows category=ps_script · 9b111d8e-92e0-4153-88bc-daefc1333aba
Detects modification of dMSA link attributes (msDS-ManagedAccountPrecededByLink) via PowerShell scripts.
This command line pattern could be an indicator an attempt to exploit the BadSuccessor privilege escalation vulnerability in Windows Server 2025.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-05-24 · logsource: product=windows service=security · e15bc294-ae2a-45ad-b7d6-637b33868bde
Detects the creation of new msDS-DelegatedManagedServiceAccount objects, which could indicate potential abuse of privilege escalation vulnerabilities in Windows Server 2025.
The msDS-DelegatedManagedServiceAccount (DMSA) is a new object class introduced in Windows Server 2025 that allows administrators to delegate the management of service accounts to other users or groups.
Attackers may exploit this feature to create unauthorized service accounts with elevated privileges, leading to privilege escalation within the Active Directory environment.
It is highly suspicious if an msDS-DelegatedManagedServiceAccount object is created without proper authorization or in an unexpected context, such as by a non-administrative user or outside of normal administrative workflows.
So, it's a good idea to look out for accounts that are not typically responsible for service account creation to detect potential abuse of this feature.
Rules tagged at the parent level (attack.t1078) 56
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
· 2023-09-03 · logsource: product=azure service=riskdetection · 128faeef-79dd-44ca-b43c-a9e236a60f49
Detects sign-in with properties that are unfamiliar to the user. The detection considers past sign-in history to look for anomalous sign-ins.
Author: Josh Nickels, Marius Rothenbücher
· 2025-01-08 · logsource: product=m365 service=audit · 13f2d3f5-6497-44a7-bf5f-dc13ffafe5dc
Detects a successful login to the Microsoft Intune Company Portal which could allow bypassing Conditional Access Policies and InTune device trust using a tool like TokenSmith.
Author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
· 2023-09-03 · logsource: product=azure service=riskdetection · 1a41023f-1e70-4026-921a-4d9341a9038e
Identifies two sign-ins originating from geographically distant locations, where at least one of the locations may also be atypical for the user, given past behavior.
Author: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'
· 2022-06-01 · logsource: product=azure service=signinlogs · 248649b7-d64f-46f0-9fb2-a52774166fb5
Device code flow is an OAuth 2.0 protocol flow specifically for input constrained devices and is not used in all environments.
If this type of flow is seen in the environment and not being used in an input constrained device scenario, further investigation is warranted.
This can be a misconfigured application or potentially something malicious.
Author: Micah Babinski (@micahbabinski), Zach Mathis (@yamatosecurity)
· 2023-01-19 (modified 2024-03-11) · logsource: product=windows service=security · 259a9cdf-c4dd-4fa2-b243-2269e5ab18a2
Detects successful logon from public IP address via RDP. This can indicate a publicly-exposed RDP port.
Author: Austin Songer
· 2021-09-06 (modified 2022-06-08) · logsource: product=azure service=auditlogs · 352a54e1-74ba-4929-9d47-8193d67aba1e
Identifies when an user or application modified the federation settings on the domain.
Author: jamesc-grafana
· 2024-07-11 · logsource: product=aws service=cloudtrail · 352a918a-34d8-4882-8470-44830c507aa3
Detects when an instance identity has taken an action that isn't inside SSM.
This can indicate that a compromised EC2 instance is being used as a pivot point.
Author: elhoim
· 2022-09-09 (modified 2023-01-04) · logsource: product=windows service=security · 39698b3f-da92-4bc6-bfb5-645a98386e45
Detects suspicious computer name samtheadmin-{1..100}$ generated by hacktool
Author: Florian Roth (Nextron Systems)
· 2017-03-17 (modified 2023-12-15) · logsource: product=windows service=security · 3ff152b2-1388-4984-9cd9-a323323fdadf
Detects interactive console logons to Server Systems
Author: MikeDuddington, '@dudders1'
· 2022-07-28 (modified 2026-05-09) · logsource: product=azure service=auditlogs · 4ad97bf5-a514-41a4-abd3-4f3455ad4865
Detects guest users being invited to tenant by non-approved inviters
Author: Tim Brown
· 2023-01-09 · logsource: product=cisco service=ldp · 50e606bf-04ce-4ca7-9d54-3449494bbd4b
Detects LDP failures which may be indicative of brute force attacks to manipulate MPLS labels
Author: Security Onion Solutions
· 2024-03-08 · logsource: product=opencanary category=application · 512cff7a-683a-43ad-afe0-dd398e872f36
Detects instances where a Telnet service on an OpenCanary node has had a login attempt.
Author: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'
· 2022-06-01 · logsource: product=azure service=signinlogs · 55695bc0-c8cf-461f-a379-2535f563c854
Resource owner password credentials (ROPC) should be avoided if at all possible as this requires the user to expose their current password credentials to the application directly.
The application then uses those credentials to authenticate the user against the identity provider.
Author: Tim Brown
· 2023-01-09 (modified 2023-01-23) · logsource: product=cisco service=bgp · 56fa3cd6-f8d6-4520-a8c7-607292971886
Detects BGP failures which may be indicative of brute force attacks to manipulate routing
Author: Harjot Singh, '@cyb3rjy0t'
· 2023-01-10 (modified 2025-07-02) · logsource: product=azure service=signinlogs · 572b12d4-9062-11ed-a1eb-0242ac120002
Detects risky authentication from a non AD registered device without MFA being required.
Author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
· 2023-09-14 · logsource: product=azure service=pim · 58af08eb-f9e1-43c8-9805-3ad9b0482bd8
Identifies when an organization doesn't have the proper license for PIM and is out of compliance.
Author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
· 2023-09-14 · logsource: product=azure service=pim · 645fd80d-6c07-435b-9e06-7bc1b5656cba
Identifies when the same privilege role has multiple activations by the same user.
Author: Austin Songer @austinsonger
· 2021-11-25 (modified 2022-12-18) · logsource: product=gcp service=gcp.audit · 6ad91e31-53df-4826-bd27-0166171c8040
Identifies when an admission controller is executed in GCP Kubernetes.
A Kubernetes Admission controller intercepts, and possibly modifies, requests to the Kubernetes API server.
The behavior of this admission controller is determined by an admission webhook (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) that the user deploys in the cluster.
An adversary can use such webhooks as the MutatingAdmissionWebhook for obtaining persistence in the cluster.
For example, attackers can intercept and modify the pod creation operations in the cluster and add their malicious container to every created pod. An adversary can use the webhook ValidatingAdmissionWebhook, which could be used to obtain access credentials.
An adversary could use the webhook to intercept the requests to the API server, record secrets, and other sensitive information.
Author: Mark Morowczynski '@markmorow', MikeDuddington, '@dudders1', Tim Shelton
· 2022-08-11 (modified 2022-08-18) · logsource: product=azure service=auditlogs · 6f583da0-3a90-4566-a4ed-83c09fe18bbf
Detects when an account was created and deleted in a short period of time.
Author: Micah Babinski (@micahbabinski), Zach Mathis (@yamatosecurity)
· 2023-01-19 (modified 2024-03-11) · logsource: product=windows service=security · 78d5cab4-557e-454f-9fb9-a222bd0d5edc
Detects successful logon from public IP address via SMB. This can indicate a publicly-exposed SMB port.
Author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
· 2023-09-14 · logsource: product=azure service=pim · 7bbc309f-e2b1-4eb1-8369-131a367d67d3
Identifies an event where there are there are too many accounts assigned the Global Administrator role.
Author: Sohan G (D4rkCiph3r)
· 2023-08-22 · logsource: product=macos category=process_creation · 821bcf4d-46c7-4b87-bc57-9509d3ba7c11
Detects attempts to enable the root account via "dsenableroot"
Author: Austin Songer @austinsonger
· 2021-11-26 (modified 2022-12-18) · logsource: product=azure service=signinlogs · 8366030e-7216-476b-9927-271d79f13cf3
Detects when there is a interruption in the authentication process.
Author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
· 2023-09-14 · logsource: product=azure service=pim · 8c6ec464-4ae4-43ac-936a-291da66ed13d
Identifies when a user has been assigned a privilege role and are not using that role.
Author: Ivan Saakov
· 2024-12-19 · logsource: product=aws service=cloudtrail · 92f84194-8d9a-4ee0-8699-c30bfac59780
Detects the import of SSH key pairs into AWS EC2, which may indicate an attacker attempting to gain unauthorized access to instances. This activity could lead to initial access, persistence, or privilege escalation, potentially compromising sensitive data and operations.
Author: oscd.community, Teymur Kheirkhabarov @HeirhabarovT, Zach Stanford @svch0st, Tim Shelton
· 2020-10-05 (modified 2022-08-03) · logsource: product=windows service=security · 941e5c45-cda7-4864-8cea-bbb7458d194a
Detects suspicious processes logging on with explicit credentials
Author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
· 2023-09-03 · logsource: product=azure service=riskdetection · 944f6adb-7a99-4c69-80c1-b712579e93e6
Indicates anomalous behavior based on suspicious sign-in activity across multiple tenants from different countries in the same browser
Author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
· 2023-09-14 · logsource: product=azure service=pim · 94a66f46-5b64-46ce-80b2-75dcbe627cc0
Identifies when a privilege role can be activated without performing mfa.
Author: Florian Roth (Nextron Systems)
· 2017-02-19 (modified 2025-10-17) · logsource: product=windows service=security · 9eb99343-d336-4020-a3cd-67f3819e68ee
This method uses uncommon error codes on failed logons to determine suspicious activity and tampering with accounts that have been disabled or somehow restricted.
Author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
· 2023-09-07 · logsource: product=azure service=riskdetection · a2cb56ff-4f46-437a-a0fa-ffa4d1303cba
Indicates user activity that is unusual for the user or consistent with known attack patterns.
Author: Tim Brown
· 2023-01-09 (modified 2023-01-23) · logsource: product=huawei service=bgp · a557ffe6-ac54-43d2-ae69-158027082350
Detects BGP failures which may be indicative of brute force attacks to manipulate routing.
Author: Austin Songer @austinsonger
· 2021-11-25 (modified 2022-12-18) · logsource: product=azure service=activitylogs · a61a3c56-4ce2-4351-a079-88ae4cbd2b58
Identifies when an admission controller is executed in Azure Kubernetes.
A Kubernetes Admission controller intercepts, and possibly modifies, requests to the Kubernetes API server.
The behavior of this admission controller is determined by an admission webhook (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) that the user deploys in the cluster.
An adversary can use such webhooks as the MutatingAdmissionWebhook for obtaining persistence in the cluster.
For example, attackers can intercept and modify the pod creation operations in the cluster and add their malicious container to every created pod.
An adversary can use the webhook ValidatingAdmissionWebhook, which could be used to obtain access credentials.
An adversary could use the webhook to intercept the requests to the API server, record secrets, and other sensitive information.
Author: Tim Brown
· 2023-01-09 (modified 2023-01-23) · logsource: product=juniper service=bgp · a7c0ae48-8df8-42bf-91bd-2ea57e2f9d43
Detects juniper BGP missing MD5 digest. Which may be indicative of brute force attacks to manipulate routing.
Author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
· 2023-09-03 · logsource: product=azure service=riskdetection · adf9f4d2-559e-4f5c-95be-c28dff0b1476
Detects sign-ins from new countries. The detection considers past activity locations to determine new and infrequent locations.
Author: Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H'
· 2022-08-09 · logsource: product=azure service=auditlogs · aeaef14c-e5bf-4690-a9c8-835caad458bd
Detects when PIM alerts are set to disabled.
Author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
· 2023-09-14 · logsource: product=azure service=pim · b1bc08d1-8224-4758-a0e6-fbcfc98c73bb
Identifies when a privilege role assignment has taken place outside of PIM and may indicate an attack.
Author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
· 2023-09-03 · logsource: product=azure service=riskdetection · b2572bf9-e20a-4594-b528-40bde666525a
Identifies user activities originating from geographically distant locations within a time period shorter than the time it takes to travel from the first location to the second.
Author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
· 2023-09-03 · logsource: product=azure service=riskdetection · be4d9c86-d702-4030-b52e-c7859110e5e8
Identifies that users were active from an IP address that has been identified as an anonymous proxy IP address.
Author: Austin Songer @austinsonger
· 2021-08-23 (modified 2022-10-09) · logsource: product=m365 service=threat_management · c191e2fa-f9d6-4ccf-82af-4f2aba08359f
Detects when a Microsoft Cloud App Security reported when a user signs into your sanctioned apps from a risky IP address.
Author: Florian Roth (Nextron Systems)
· 2017-03-14 (modified 2021-01-17) · logsource: product=windows service=security · c265cf08-3f99-46c1-8d59-328247057d57
Detects the addition of a new member to the local administrator group, which could be legitimate activity or a sign of privilege escalation activity
Author: Mark Morowczynski '@markmorow', MikeDuddington, '@dudders1'
· 2022-08-11 (modified 2023-12-15) · logsource: product=azure service=auditlogs · c98184ba-4a27-4e10-b7b7-da48e71f4d25
Detects accounts that are created or deleted by non-approved users.
Author: Austin Songer @austinsonger
· 2021-11-26 (modified 2022-12-25) · logsource: product=azure service=auditlogs · ca9bf243-465e-494a-9e54-bf9fc239057d
Detects when a user has been elevated to manage all Azure Subscriptions.
This change should be investigated immediately if it isn't planned.
This setting could allow an attacker access to Azure subscriptions in your environment.
Author: Security Onion Solutions
· 2024-03-08 · logsource: product=opencanary category=application · cd55f721-5623-4663-bd9b-5229cab5237d
Detects instances where an SSH service on an OpenCanary node has had a connection attempt.
Author: Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H'
· 2022-08-11 (modified 2023-12-15) · logsource: product=azure service=signinlogs · cf1e5687-84e1-41af-97a9-158094efef53
Detects failed sign-in due to user not meeting expected controls for adminitrators
Author: Tim Shelton (HAWK.IO)
· 2021-12-09 (modified 2023-02-21) · logsource: product=windows category=process_creation · d4498716-1d52-438f-8084-4a603157d131
Detects a when net.exe is called with a password in the command line
Author: Sohan G (D4rkCiph3r)
· 2023-02-18 · logsource: product=macos category=process_creation · d7329412-13bd-44ba-a072-3387f804a106
Detects attempts to enable the guest account using the sysadminctl utility
Author: Austin Songer @austinsonger
· 2020-07-06 (modified 2021-11-27) · logsource: product=m365 service=threat_management · d7eab125-5f94-43df-8710-795b80fa1189
Detects when a Microsoft Cloud App Security reported a risky sign-in attempt due to a login associated with an impossible travel.
Author: frack113
· 2022-02-21 · logsource: product=windows category=ps_module · e3818659-5016-4811-a73c-dde4679169d2
The Reset-ComputerMachinePassword cmdlet changes the computer account password that the computers use to authenticate to the domain controllers in the domain.
You can use it to reset the password of the local computer.
Author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
· 2023-09-14 · logsource: product=azure service=pim · e402c26a-267a-45bd-9615-bd9ceda6da85
Identifies when an account hasn't signed in during the past n number of days.
Author: Tom Kluter
· 2026-04-28 · logsource: product=gcp service=google_workspace.login · eafe6f2b-cfec-4612-aec2-49563c33a087
Detects a login attempt in Google Workspace flagged as a potential attack by a government-backed threat actor
Author: Raphaël CALVET, @MetallicHack
· 2021-10-04 (modified 2026-04-30) · logsource: product=azure service=auditlogs · ebbeb024-5b1d-4e16-9c0c-917f86c708a7
User Added to an Administrator's Azure AD Role
Author: kelnage
· 2024-07-11 · logsource: product=kubernetes service=audit · eed82177-38f5-4299-8a76-098d50d225ab
Detects when a modification (create, update or replace) action is taken that affects mutating or validating webhook configurations, as they can be used by an adversary to achieve persistence or exfiltrate access credentials.
Author: MikeDuddington, '@dudders1'
· 2022-07-28 (modified 2026-05-08) · logsource: product=azure service=signinlogs · f272fb46-25f2-422c-b667-45837994980f
Detect when authentications to important application(s) only required single-factor authentication
Author: Austin Songer
· 2021-09-22 (modified 2022-12-18) · logsource: product=aws service=cloudtrail · f43f5d2f-3f2a-4cc8-b1af-81fde7dbaf0e
Identifies when suspicious SAML activity has occurred in AWS. An adversary could gain backdoor access via SAML.
Author: NVISO
· 2020-05-06 (modified 2024-03-11) · logsource: product=windows service=security · f88e112a-21aa-44bd-9b01-6ee2a2bbbed1
Detects a failed logon attempt from a public IP. A login from a public IP can indicate a misconfigured firewall or network boundary.
Author: Security Onion Solutions
· 2024-03-08 · logsource: product=opencanary category=application · ff7139bc-fdb1-4437-92f2-6afefe8884cb
Detects instances where an SSH service on an OpenCanary node has had a login attempt.