t1078-003-local-accounts

name	T1078.003_local-accounts
description	Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
category	configuration
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1078.003","defense-evasion","persistence","privilege-escalation","initial-access","linux","macos","windows","containers","network-devices","esxi","sub-technique"]
technique_id	T1078.003
tactic	defense-evasion
all_tactics	["defense-evasion","persistence","privilege-escalation","initial-access"]
platforms	["Linux","macOS","Windows","Containers","Network Devices","ESXi"]
mitre_url	https://attack.mitre.org/techniques/T1078/003
tech_stack	["linux","macos","windows","containers","network devices","esxi"]
cwe_ids	["CWE-693"]
chains_with	["T1078","T1078.001","T1078.002","T1078.004"]
prerequisites	["T1078"]
severity_boost	{"T1078":"Chain with T1078 for deeper attack path","T1078.001":"Chain with T1078.001 for deeper attack path","T1078.002":"Chain with T1078.002 for deeper attack path"}

T1078.003 Local Accounts

Sub-technique of: T1078

High-Level Description

Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service.

Local Accounts may also be abused to elevate privileges and harvest credentials through OS Credential Dumping. Password reuse may allow the abuse of local accounts across a set of machines on a network for the purposes of Privilege Escalation and Lateral Movement.

Kill Chain Phase

• Defense Evasion (TA0005)
• Persistence (TA0003)
• Privilege Escalation (TA0004)
• Initial Access (TA0001)

Platforms: Linux, macOS, Windows, Containers, Network Devices, ESXi

What to Check

• Identify if Local Accounts technique is applicable to target environment
• Check Linux systems for indicators of Local Accounts
• Check macOS systems for indicators of Local Accounts
• Check Windows systems for indicators of Local Accounts
• Verify mitigations are bypassed or absent (4 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: Create local account with admin privileges

After execution the new account will be active and added to the Administrators group

Supported Platforms: windows Elevation Required: Yes

net user art-test /add
net user art-test #{password}
net localgroup administrators art-test /add

Atomic Test 2: Create local account with admin privileges - MacOS

After execution the new account will be active and added to the Administrators group

Supported Platforms: macos Elevation Required: Yes

dscl . -create /Users/AtomicUser
dscl . -create /Users/AtomicUser UserShell /bin/bash
dscl . -create /Users/AtomicUser RealName 
dscl . -create /Users/AtomicUser UniqueID 503
dscl . -create /Users/AtomicUser PrimaryGroupID 503
dscl . -create /Users/AtomicUser NFSHomeDirectory /Local/Users/AtomicUser
dscl . -passwd /Users/AtomicUser mySecretPassword
dscl . -append /Groups/admin GroupMembership AtomicUser