自动化接入 · API / MCP EN

技术说明 · T1078.002

Domain Accounts

Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover users, administrators, and services. Adversaries may compromise domain accounts, some with a high level of privileges, through various means such as OS Credential Dumping or password reuse, allowing access to privileged resources of the domain.

ATT&CK T1078.002 platforms — 状态 有效 版本 20.1

Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.1 Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover users, administrators, and services.2 Adversaries may compromise domain accounts, some with a high level of privileges, through various means such as OS Credential Dumping or password reuse, allowing access to privileged resources of the domain.

  1. TechNet Credential Theft
  2. Microsoft AD Accounts

使用该技术的组织

组织名称国家
grp_g0028Threat Group-1314—
grp_g1030AgriusIran
grp_g0019Naikon—
grp_g1043BlackByte—
grp_g1023APT5China
grp_g0143Aquatic PandaChina
grp_g1021Cinnamon TempestChina
grp_g0119Indrik SpiderRussia
grp_g1057ShinyHunters—
grp_g0114ChimeraChina
grp_g0102Wizard SpiderRussia
grp_g1040Play—
grp_g0049OilRigIran
grp_g1055VOID MANTICORE—
grp_g1017Volt Typhoon—
grp_g1059NIMBUS MANTICORE—
grp_g0022APT3China
grp_g0092TA505—
grp_g0059Magic HoundIran
grp_g1022ToddyCat—
grp_g0034Sandworm TeamRussia

断言

尚无指向该技术的公开断言。

记录自动入库·未人工复核；置信度与有效期按引用读取。