T1078.002 — Domain Accounts

Tactics: Stealth, Persistence, Privilege Escalation, Initial Access · Platforms: ESXi, Linux, macOS, Windows

Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and…

Sub-technique of Valid Accounts (T1078).

Sigma detection rules (4)

T1078.002 Valid Accounts: Domain Accounts

title: "T1078.002 Valid Accounts: Domain Accounts"
id: 8d2a99e5-7a91-4a3c-ba2f-3c00dd57da63
description: 'Abuse of Domain Accounts. (Retargeted to the Security-log authentication event that actually reflects domain-account logon activity; see logsource below.) Tune using: TimeWindow, KnownAdminAllowlist, LogonTypeScope.'
references:
  - https://attack.mitre.org/techniques/T1078/002
author: Shahrukh Khan
date: 2026-01-24
license: MIT
tags:
  - attack.stealth
  - attack.persistence
  - attack.privilege-escalation
  - attack.initial-access
  - attack.t1078.002

logsource:
  product: windows
  service: security

detection:
  selection:
    EventID: 4624
    LogonType:
      - 3
      - 10
  filter_local_special:
    TargetDomainName:
      - 'NT AUTHORITY'
      - 'Window Manager'
      - 'Font Driver Host'

  condition: selection and not filter_local_special

falsepositives:
  - Legitimate domain-admin interactive/remote sessions; this rule is intentionally broad and needs pairing with a known-domain-admin allowlist or anomalous-logon-time correlation to be useful standalone.

level: medium

T1078.002 Valid Accounts: Domain Accounts

title: "T1078.002 Valid Accounts: Domain Accounts"
id: a7b878a5-3ebd-4247-9438-7e0ee2e604c7
description: 'Abuse of Domain Accounts. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Fixed: a successful domain-account logon (acct containing @) is normal sssd/winbind behavior on its own, so the rule now excludes obvious service/machine account naming (svc_ prefix, $ machine-account suffix) and is paired with a value_count correlation rule that flags a single domain account authenticating to an anomalous number of distinct hosts in a short window, giving the rule an actual anomaly condition instead of deferring all discrimination to falsepositive tuning notes. Tune using: HostnameScope, AccountDomain.'
references:
  - https://attack.mitre.org/techniques/T1078/002
author: Shahrukh Khan
date: 2026-04-10
modified: 2026-07-26
license: MIT
tags:
  - attack.stealth
  - attack.persistence
  - attack.privilege-escalation
  - attack.initial-access
  - attack.t1078.002

logsource:
  product: linux
  service: auditd

detection:
  selection:
    type: USER_AUTH
    res: success
  selection_domain:
    type: USER_AUTH
    acct|contains: '@'
  filter_service:
    type: USER_AUTH
    acct|contains:
      - 'svc_'
      - '$@'

  condition: selection and selection_domain and not filter_service

falsepositives:
  - sssd/winbind-joined Linux hosts authenticate domain accounts (user@domain) as routine business-as-usual; this rule now excludes common service/machine-account naming, but real anomaly discrimination comes from the paired multi-host-spread correlation rule rather than this base rule alone.

level: low
---
title: "T1078.002 Valid Accounts: Domain Accounts - Rapid Multi-Host Authentication"
id: d9f4b2a7-6c3e-48d1-9a2f-5e7c1b3d8f42
description: 'Correlation companion for a7b878a5-3ebd-4247-9438-7e0ee2e604c7: counts the number of distinct hosts a single domain account successfully authenticates to within a 30-minute window (requires a hostname field on centrally-ingested auditd/syslog events), approximating anomalous credential reuse or lateral movement across the domain-joined fleet rather than routine single-host sssd/winbind logon.'
status: experimental
correlation:
  type: value_count
  rules:
    - a7b878a5-3ebd-4247-9438-7e0ee2e604c7
  group-by:
    - acct
  timespan: 30m
  condition:
    field: hostname
    gte: 3
level: high

T1078.002 Valid Accounts: Domain Accounts

title: "T1078.002 Valid Accounts: Domain Accounts"
id: f63d8487-cac6-41df-8602-382381859a9d
description: 'Abuse of Domain Accounts. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: UserLocation, LogonMethod.'
references:
  - https://attack.mitre.org/techniques/T1078/002
author: Shahrukh Khan
date: 2026-02-06
license: MIT
tags:
  - attack.stealth
  - attack.persistence
  - attack.privilege-escalation
  - attack.initial-access
  - attack.t1078.002

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith: '/dscl'
    CommandLine|contains: '/Active Directory/'

  condition: selection

falsepositives:
  - Routine directory-service queries by management agents against a bound Active Directory domain use the same command.

level: medium

T1078.002 Valid Accounts: Domain Accounts

title: "T1078.002 Valid Accounts: Domain Accounts"
id: cc71f101-2834-43c1-8c7f-bba8ca39b40c
description: 'Abuse of Domain Accounts. (Retargeted to the process_creation ESXi telemetry that actually captures this techniques behavior; see logsource below.) Tune using: AccountType, LoginInterface.'
references:
  - https://attack.mitre.org/techniques/T1078/002
author: Shahrukh Khan
date: 2026-05-12
license: MIT
tags:
  - attack.stealth
  - attack.persistence
  - attack.privilege-escalation
  - attack.initial-access
  - attack.t1078.002

logsource:
  product: esxi
  service: vpxa

detection:
  selection:
    Message|contains: 'authentication'
  selection_ad:
    Message|contains: 'AD'

  condition: selection and selection_ad

falsepositives:
  - Normal Active Directory-integrated logins by legitimate domain administrators to manage the host also generate these vpxa authentication events, and vpxa text logging does not reliably expose account privilege tier.

level: medium

Related sub-techniques

Explore