Technique:  Valid Accounts
During the 2015 Ukraine Electric Power Attack, It used valid accounts on the corporate network to escalate privileges, move laterally, and establish persistence within the corporate network.
It actors leverage legitimate credentials to log into external remote services.
It has used legitimate credentials to gain initial access, maintain access, and exfiltrate data from a victim network. The group has specifically used credentials stolen through a spearphishing email to login to the DCCC network. The group has also leveraged default manufacturer's passwords to gain initial access to corporate networks via IoT devices such as a VOIP phone, printer, and video decoder.
It has used a compromised account to access an organization's VPN infrastructure.
It has used valid accounts for initial access and privilege escalation.
It has used stolen credentials to compromise Outlook Web Access (OWA).
It used compromised credentials to log on to other systems.
It has used previously compromised administrative accounts to escalate privileges.
It actors used legitimate credentials of banking employees to perform operations that sent them millions of dollars.
It has used a valid account to maintain persistence via scheduled task.
It has compromised user credentials and used valid accounts for operations.
Dtrack used hard-coded credentials to gain access to a network share.
Adversaries can instruct Duqu to spread laterally by copying itself to shares it has enumerated and for which it has obtained legitimate credentials (via keylogging or other means). The remote host is then infected by using the compromised credentials to schedule a task on remote machines that executes the malware.
It has used stolen credentials to connect remotely to victim networks using VPNs protected with only a single factor.
It has used legitimate credentials to hijack email communications.
It has used legitimate VPN, RDP, Citrix, or VNC credentials to maintain access to a victim environment.
To move laterally on a victim network, It has used credentials stolen from various systems on which it gathered usernames and password hashes.
It has harvested valid administrative credentials for lateral movement.
It has used valid accounts for persistence and lateral movement.
It has used valid credentials with various services during lateral movement.
It leveraged valid accounts to maintain access to a victim network.
Industroyer can use supplied user credentials to execute processes and stop services.
It has used credential dumpers or stealers to obtain legitimate credentials, which they used to gain access to victim accounts.
Kinsing has used valid SSH credentials to access remote hosts.
It has used compromised credentials and/or session tokens to gain access into a victim's VPN, VDI, RDP, and IAMs.
It has used administrator credentials to gain access to restricted network segments.
It has obtained valid accounts to gain initial access.
Linux Rabbit acquires valid SSH accounts through brute force.
It has used valid accounts including shared between Managed Service Providers and clients to move between the two environments.
During Night Dragon, threat actors used compromised VPN accounts to gain access to victim systems.
It has used compromised credentials to access other systems on a victim network.
During Operation Wocao, threat actors used valid VPN credentials to gain initial access.
It attempts to obtain legitimate credentials during operations.
It has used valid compromised credentials to gain access to victim environments.
It have used previously acquired legitimate credentials prior to attacks.
Some SeaDuke samples have a module to extract email from Microsoft Exchange servers using compromised credentials.
It has used compromised credentials to log on to other systems and escalate privileges.
It has used compromised credentials to obtain unauthorized access to online accounts.
During the SolarWinds Compromise, It used different compromised credentials for remote access and to move laterally.
It used legitimate account credentials that they dumped to navigate the internal victim network as though they were the legitimate account owner.
It has used compromised VPN accounts.
It actors obtain legitimate credentials using a variety of methods and use them to further lateral movement on victim networks.
It has used valid credentials for privileged accounts with the goal of accessing domain controllers.