Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service. Local Accounts may also be abused to elevate privileges and harvest credentials through OS Credential Dumping. Password reuse may allow the abuse of local accounts across a set of machines on a network for the purposes of Privilege Escalation and Lateral Movement.
Groups using this technique
| Group | Name | Country |
|---|---|---|
| grp_g0051 | FIN10 | — |
| grp_g1047 | Velvet Ant | — |
| grp_g0056 | PROMETHIUM | — |
| grp_g1041 | Sea Turtle | — |
| grp_g1040 | Play | — |
| grp_g0082 | APT38 | DPRK |
| grp_g0081 | Tropic Trooper | — |
| grp_g1059 | NIMBUS MANTICORE | — |
| grp_g0046 | FIN7 | — |
| grp_g0010 | Turla | Russia |
| grp_g0125 | HAFNIUM | — |
| grp_g0094 | Kimsuky | DPRK |
| grp_g0016 | APT29 | Russia |
| grp_g0050 | APT32 | Vietnam |
Claims
No public claim points at this technique yet.
Auto-ingested and not human-reviewed; confidence and validity read by citation.