{"id":"T1078.002","name":"Domain Accounts","url":"https://attack.mitre.org/techniques/T1078/002","tactics":["stealth","persistence","privilege-escalation","initial-access"],"platforms":["ESXi","Linux","macOS","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0210","stix_id":"x-mitre-detection-strategy--ba7a75c6-fcf5-4f36-8908-1fe1c30f690f","name":"Abuse of Domain Accounts","url":"https://attack.mitre.org/detectionstrategies/DET0210","analytics":[{"id":"AN0590","stix_id":"x-mitre-analytic--c7706ddb-cf88-41c7-981b-a5e1bf6cfcfc","name":"Analytic 0590","description":"Detection of suspicious logon behavior using valid domain accounts across multiple hosts, off-hours, or simultaneous sessions from geographically distant locations.","url":"https://attack.mitre.org/detectionstrategies/DET0210#AN0590","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Security","channel":"EventCode=4624, 4625, 4768, 4769","data_component":"DC0088","data_component_name":"Logon Session Metadata","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=3, 22","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"TimeWindow","description":"Tune for detection of off-hours or abnormal logon spikes."},{"field":"UserContext","description":"Scope to sensitive domain accounts (e.g., Domain Admins)."},{"field":"LogonType","description":"Distinguish between interactive, service, and network logons."}],"live":true,"detection_strategies":["DET0210"],"techniques":["T1078.002"]},{"id":"AN0591","stix_id":"x-mitre-analytic--74aade7b-b61a-46d0-a68b-33fba4f09f6e","name":"Analytic 0591","description":"Use of domain accounts via sssd or winbind for logon activity outside of typical patterns, especially on sensitive systems or with lateral movement tools.","url":"https://attack.mitre.org/detectionstrategies/DET0210#AN0591","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"pam_authenticate, sshd","data_component":"DC0002","data_component_name":"User Account Authentication","log_source_slug":"auditd-syscall"},{"name":"linux:syslog","channel":"sssd / sudo logs","data_component":"DC0088","data_component_name":"Logon Session Metadata","log_source_slug":"linux-syslog"}],"mutable_elements":[{"field":"HostnameScope","description":"Filter to high-value systems (e.g., domain-joined servers)."},{"field":"AccountDomain","description":"Identify trusted domains versus external or misconfigured domains."}],"live":true,"detection_strategies":["DET0210"],"techniques":["T1078.002"]},{"id":"AN0592","stix_id":"x-mitre-analytic--96050801-dc36-462f-982e-df2806eaa3ea","name":"Analytic 0592","description":"Domain logins using network accounts or mobile accounts via Open Directory or Active Directory plugins, especially outside business hours or on atypical endpoints.","url":"https://attack.mitre.org/detectionstrategies/DET0210#AN0592","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"log show --predicate 'eventMessage contains \"Authentication\"'","data_component":"DC0002","data_component_name":"User Account Authentication","log_source_slug":"macos-unifiedlog"}],"mutable_elements":[{"field":"UserLocation","description":"Geo-IP or VPN source context for abnormal remote access."},{"field":"LogonMethod","description":"Control for expected services (e.g., GUI login vs. SSH)."}],"live":true,"detection_strategies":["DET0210"],"techniques":["T1078.002"]},{"id":"AN0593","stix_id":"x-mitre-analytic--f931e587-28f8-4923-b054-98d6348dcafe","name":"Analytic 0593","description":"Login to vSphere or ESXi hosts using domain accounts, especially those associated with vpxuser or unexpected group memberships.","url":"https://attack.mitre.org/detectionstrategies/DET0210#AN0593","platforms":["ESXi"],"log_source_references":[{"name":"esxi:vpxd","channel":"/var/log/vmware/vpxd.log","data_component":"DC0002","data_component_name":"User Account Authentication","log_source_slug":"esxi-vpxd"},{"name":"esxi:hostd","channel":"/var/log/hostd.log","data_component":"DC0088","data_component_name":"Logon Session Metadata","log_source_slug":"esxi-hostd"}],"mutable_elements":[{"field":"AccountType","description":"Prioritize detection on accounts with elevated access."},{"field":"LoginInterface","description":"Distinguish interactive UI login from API or SSH access."}],"live":true,"detection_strategies":["DET0210"],"techniques":["T1078.002"]}],"live":true,"version":"1.0","techniques":["T1078.002"]}],"sigma_rules":[{"id":"02122374-b74e-495c-b285-9e4da973f3d6","title":"DMSA Service Account Created in Specific OUs - PowerShell","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"medium","date":"2025-05-24","modified":null,"description":"Detects the creation of a dMSA service account using the New-ADServiceAccount cmdlet in certain OUs.\nThe fact that the cmdlet is used to create a dMSASvc account in a specific OU is highly suspicious.\nIt is a pattern trying to exploit the BadSuccessor privilege escalation vulnerability in Windows Server 2025.\nOn top of that, if the user that is creating the dMSASvc account is not a legitimate administrator or does not have the necessary permissions,\nit is a strong signal of an attempted or successful abuse of the BaDSuccessor vulnerability for privilege escalation within the Windows Server 2025 Active Directory environment.\n","references":["https://www.akamai.com/blog/security-research/abusing-bad-successor-for-privilege-escalation-in-active-directory"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.privilege-escalation","attack.initial-access","attack.persistence","attack.stealth","attack.t1078.002","attack.t1098"],"path":"rules/windows/powershell/powershell_script/posh_ps_create_new_dmsasvc_account.yml","techniques":["T1078.002","T1098"],"cves":[]},{"id":"0ea8db81-2ff6-4525-9448-33bbe7effc13","title":"New DMSA Service Account Created in Specific OUs","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"medium","date":"2025-05-24","modified":null,"description":"Detects the creation of a dMSASvc account using the New-ADServiceAccount cmdlet in certain OUs.\nThe fact that the Cmdlet is used to create a dMSASvc account in a specific OU is highly suspicious.\nIt is a pattern trying to exploit the BadSuccessor privilege escalation vulnerability in Windows Server 2025.\nOn top of that, if the user that is creating the dMSASvc account is not a legitimate administrator or does not have the necessary permissions,\nit is a strong signal of an attempted or successful abuse of the BaDSuccessor vulnerability for privilege escalation within the Windows Server 2025 Active Directory environment.\n","references":["https://www.akamai.com/blog/security-research/abusing-bad-successor-for-privilege-escalation-in-active-directory"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.initial-access","attack.persistence","attack.stealth","attack.t1078.002","attack.t1098"],"path":"rules/windows/process_creation/proc_creation_win_create_new_dmsasvc_account.yml","techniques":["T1078.002","T1098"],"cves":[]},{"id":"0f63e1ef-1eb9-4226-9d54-8927ca08520a","title":"Admin User Remote Logon","author":"juju4","status":"test","level":"low","date":"2017-10-29","modified":"2022-10-09","description":"Detect remote login by Administrator user (depending on internal pattern).","references":["https://car.mitre.org/wiki/CAR-2016-04-005"],"logsource":{"product":"windows","service":"security"},"tags":["attack.privilege-escalation","attack.persistence","attack.lateral-movement","attack.initial-access","attack.stealth","attack.t1078.001","attack.t1078.002","attack.t1078.003","car.2016-04-005"],"path":"rules/windows/builtin/security/account_management/win_security_admin_rdp_login.yml","techniques":["T1078.001","T1078.002","T1078.003"],"cves":[]},{"id":"352a918a-34d8-4882-8470-44830c507aa3","title":"Malicious Usage Of IMDS Credentials Outside Of AWS Infrastructure","author":"jamesc-grafana","status":"test","level":"high","date":"2024-07-11","modified":null,"description":"Detects when an instance identity has taken an action that isn't inside SSM.\nThis can indicate that a compromised EC2 instance is being used as a pivot point.\n","references":["https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-identity-roles.html","https://ermetic.com/blog/aws/aws-ec2-imds-what-you-need-to-know/","https://www.packetmischief.ca/2023/07/31/amazon-ec2-credential-exfiltration-how-it-happens-and-how-to-mitigate-it/#lifting-credentials-from-imds-this-is-why-we-cant-have-nice-things"],"logsource":{"product":"aws","service":"cloudtrail"},"tags":["attack.privilege-escalation","attack.initial-access","attack.persistence","attack.stealth","attack.t1078","attack.t1078.002"],"path":"rules/cloud/aws/cloudtrail/aws_cloudtrail_imds_malicious_usage.yml","techniques":["T1078","T1078.002"],"cves":[]},{"id":"6c9eb492-e477-4df9-b0f4-571fc9db29cd","title":"msDS-ManagedAccountPrecededByLink Attribute Modified","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"medium","date":"2025-05-24","modified":null,"description":"Detects modifications to the msDS-ManagedAccountPrecededByLink attribute, which may indicate an attempted or successful abuse of the BaD-Successor msDS-DelegatedManagedServiceAccount (DMSA) vulnerability.\nThe DMSA is a new object class introduced in Windows Server 2025 that allows administrators to delegate the management of service accounts to other users or groups.\nChanges to this attribute by suspicious accounts or outside of normal administrative workflows are a strong signal of an attempted or successful abuse.\nIf it is indeed modified by an account that is not typically responsible for such changes, it could indicate an attempt to exploit the BaD-Successor vulnerability for privilege escalation within the Windows Server 2025 Active Directory environment.\n","references":["https://www.akamai.com/blog/security-research/abusing-bad-successor-for-privilege-escalation-in-active-directory"],"logsource":{"product":"windows","service":"security"},"tags":["attack.privilege-escalation","attack.initial-access","attack.persistence","attack.stealth","attack.t1078.002","attack.t1098"],"path":"rules-placeholder/windows/builtin/security/win_security_modification_of_msds_dmsa_link_attribute.yml","techniques":["T1078.002","T1098"],"cves":[]},{"id":"9b111d8e-92e0-4153-88bc-daefc1333aba","title":"DMSA Link Attributes Modified","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"low","date":"2025-05-24","modified":null,"description":"Detects modification of dMSA link attributes (msDS-ManagedAccountPrecededByLink) via PowerShell scripts.\nThis command line pattern could be an indicator an attempt to exploit the BadSuccessor privilege escalation vulnerability in Windows Server 2025.\n","references":["https://www.akamai.com/blog/security-research/abusing-bad-successor-for-privilege-escalation-in-active-directory"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.privilege-escalation","attack.persistence","attack.initial-access","attack.stealth","attack.t1078.002","attack.t1098"],"path":"rules/windows/powershell/powershell_script/posh_ps_modification_of_dmsa_link_attribute.yml","techniques":["T1078.002","T1098"],"cves":[]},{"id":"e15bc294-ae2a-45ad-b7d6-637b33868bde","title":"New MsDS-DelegatedManagedServiceAccount (DMSA) Object Created","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"medium","date":"2025-05-24","modified":null,"description":"Detects the creation of new msDS-DelegatedManagedServiceAccount objects, which could indicate potential abuse of privilege escalation vulnerabilities in Windows Server 2025.\nThe msDS-DelegatedManagedServiceAccount (DMSA) is a new object class introduced in Windows Server 2025 that allows administrators to delegate the management of service accounts to other users or groups.\nAttackers may exploit this feature to create unauthorized service accounts with elevated privileges, leading to privilege escalation within the Active Directory environment.\nIt is highly suspicious if an msDS-DelegatedManagedServiceAccount object is created without proper authorization or in an unexpected context, such as by a non-administrative user or outside of normal administrative workflows.\nSo, it's a good idea to look out for accounts that are not typically responsible for service account creation to detect potential abuse of this feature.\n","references":["https://www.akamai.com/blog/security-research/abusing-dmsa-for-privilege-escalation-in-active-directory"],"logsource":{"product":"windows","service":"security"},"tags":["attack.privilege-escalation","attack.initial-access","attack.persistence","attack.stealth","attack.t1078.002","attack.t1098"],"path":"rules-placeholder/windows/builtin/security/win_security_msds_dmsa_object_creation.yml","techniques":["T1078.002","T1098"],"cves":[]}],"kev_cves":[],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}