T1078.003 Local Accounts
sub-techniqueEnterpriseAdversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service. Local Accounts may also be abused to elevate privileges and harvest credentials through OS Credential Dumping. Password reuse may allow the abuse of local accounts across a set of machines on a network for the purposes of Privilege Escalation and Lateral Movement.
platforms
Platforms this applies to.
tactics
ATT&CK tactics this technique serves.
sub-technique of
The broader entity this sits under.
mitigations
ATT&CK mitigations that reduce this.
detected by (3)
Data components that detect this.
countered by (D3FEND)
D3FEND countermeasures that counter this.
NIST CSF 2.0 — areas of relevance (Protect / Detect)
NIST CSF 2.0 areas this most relates to (evidence-ranked).
- PR.PSPlatform Securitymoderate · backed by 8 of 19 mapped controls
- ID.RARisk Assessmentmoderate · backed by 7 of 19 mapped controls
- PR.AAIdentity Management, Authentication, and Access Controlmoderate · backed by 6 of 19 mapped controls
Derived from MITRE CTID (Apache-2.0) and the NIST 800-53 ↔ CSF crosswalk (public domain). Indicative relevance along the Protect/Detect axis — not a compliance assessment or coverage claim.
mitigating controls (19)
Security controls that mitigate this.
known-exploited CVEs (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2021-44168US | high7.8OT critical | KEV | ||
A download of code without integrity check vulnerability in the "execute restore src-vis" command of FortiOS before 7.0.3 may allow a local authenticated attacker to download arbit… | ||||
groups (14)
Threat groups associated with this.
software (5)
Malware and tools associated with this.
campaigns (5)
Campaigns that use this.
Detected by (Sigma) (5)
Sigma detection rules related to this.
source
Where this definition is published.