T1078.003 — Local Accounts

Tactics: Stealth, Persistence, Privilege Escalation, Initial Access · Platforms: Containers, ESXi, Linux, macOS, Network Devices, Windows

Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system…

Sub-technique of Valid Accounts (T1078).

Sigma detection rules (3)

T1078.003 Valid Accounts: Local Accounts

title: "T1078.003 Valid Accounts: Local Accounts"
id: 0b2334e5-bc4a-4cff-8476-9732ca889d27
description: 'Detection of Local Account Abuse for Initial Access and Persistence. (Data Component: Logon Session Creation; baseline tier: windows-eventid.) Tune using: TimeWindow, UserContext.'
references:
  - https://attack.mitre.org/techniques/T1078/003
author: Shahrukh Khan
date: 2026-01-03
license: MIT
tags:
  - attack.stealth
  - attack.persistence
  - attack.privilege-escalation
  - attack.initial-access
  - attack.t1078.003

logsource:
  product: windows
  service: security

detection:
  selection:
    EventID:
      - '4624'
      - '4648'

  selection_local_account:
    TargetDomainName|fieldref: ComputerName

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and selection_local_account and not filter_system_account

falsepositives:
  - System and service accounts (SYSTEM, LOCAL SERVICE, NETWORK SERVICE) performing the same action are excluded via filter_system_account; tune further with process/path allowlists if noise remains.

level: medium

T1078.003 Valid Accounts: Local Accounts

title: "T1078.003 Valid Accounts: Local Accounts"
id: bed21232-64d2-4d46-ba58-1d98c8a3ebb7
description: 'Detection of Local Account Abuse for Initial Access and Persistence. (Narrowed from raw USER_LOGIN success, which matched essentially every login regardless of authentication source, to logins specifically authenticated against the local Unix password database (pam_unix) and not via a centralized identity backend (SSSD/Kerberos/LDAP) -- since T1078.003 is specifically about local, non-domain accounts. Still requires TimeWindow/HostRole tuning to separate abuse from routine local admin access.) Tune using: TimeWindow, HostRole.'
references:
  - https://attack.mitre.org/techniques/T1078/003
author: Shahrukh Khan
date: 2026-02-13
license: MIT
tags:
  - attack.stealth
  - attack.persistence
  - attack.privilege-escalation
  - attack.initial-access
  - attack.t1078.003

logsource:
  product: linux
  service: auditd

detection:
  selection:
    type: USER_LOGIN
    res: success
  selection_local_auth:
    grantors|contains: 'pam_unix'
  filter_domain_auth:
    grantors|contains:
      - 'pam_sss'
      - 'pam_krb5'
      - 'pam_ldap'
  condition: selection and selection_local_auth and not filter_domain_auth

falsepositives:
  - Local account logons authenticated via pam_unix happen constantly for legitimate console/SSH admin access on hosts without centralized identity; this rule is intentionally still broad and needs off-hours/host-role tuning to be actionable.

level: low

T1078.003 Valid Accounts: Local Accounts

title: "T1078.003 Valid Accounts: Local Accounts"
id: dc3ccb14-3e8d-4d9e-bded-e32e8d56e757
description: 'Detection of Local Account Abuse for Initial Access and Persistence. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: UserContext, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1078/003
author: Shahrukh Khan
date: 2026-06-01
license: MIT
tags:
  - attack.stealth
  - attack.persistence
  - attack.privilege-escalation
  - attack.initial-access
  - attack.t1078.003

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    ParentImage|endswith: '/sshd'
    Image|endswith:
      - '/bash'
      - '/zsh'
    User|contains: 'admin'

  condition: selection

falsepositives:
  - Legitimate remote administration via SSH to local admin accounts for scheduled maintenance windows.

level: medium

Related sub-techniques

Explore