Applied Cybernetics Group
T1078.002 Domain Accounts
- Technique
T1078.002- Tactics
- Defense Evasion, Persistence, Privilege Escalation, Initial Access
- Research, 90 days
- 1
- KEV CVEs mapped
- 0
- SigmaHQ rules
- 5
- Elastic, Splunk
- 22
- thrunt rules
- 0
- Upstream
- https://attack.mitre.org/techniques/T1078/002
MITRE description
Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.(Citation: TechNet Credential Theft) Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover users, administrators, and services.(Citation: Microsoft AD Accounts) Adversaries may compromise domain accounts, some with a high level of privileges, through various means such as [OS Credential Dumping](https://attack.mitre.org/techniques/T1003) or password reuse, allowing access to privileged resources of the domain.
Research citing this technique
Reports and advisories from the last 90 days that cite this technique.
-
2026-09-21Kaspersky Securelist: Group Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPO
Detection coverage
SigmaHQ community rules
- Malicious Usage Of IMDS Credentials Outside Of AWS Infrastructure (core)
- Admin User Remote Logon (core)
- DMSA Service Account Created in Specific OUs - PowerShell (core)
- DMSA Link Attributes Modified (core)
- New DMSA Service Account Created in Specific OUs (core)
Elastic and Splunk rules
- Spike in Special Logon Events (elastic)
- Spike in Successful Logon Events from a Source IP (elastic)
- Rare User Logon (elastic)
- Unusual Windows Username (elastic)
- Unusual Windows User Privilege Elevation Activity (elastic)
- First Time Seen Account Performing DCSync (elastic)
- Potential Credential Access via DCSync (elastic)
- Kerberos Pre-authentication Disabled for User (elastic)
- Access to a Sensitive LDAP Attribute (elastic)
- AdminSDHolder Backdoor (elastic)
- AdminSDHolder SDProp Exclusion Added (elastic)
- Delegated Managed Service Account Modification by an Unusual User (elastic)
- dMSA Account Creation by an Unusual User (elastic)
- Potential Privileged Escalation via SamAccountName Spoofing (elastic)
- Remote Computer Account DnsHostName Update (elastic)
- Detect Excessive Account Lockouts From Endpoint (splunk)
- Suspicious Computer Account Name Change (splunk)
- Suspicious Kerberos Service Ticket Request (splunk)
- Suspicious Ticket Granting Ticket Request (splunk)
- Windows AD User Suspicious UPN Change (splunk)
- Windows Group Policy Object Created (splunk)
- Windows PowerView AD Access Control List Enumeration (splunk)