T1078.002 Domain Accounts — Detection Rules

Source-backed rule directory

• Malicious Usage Of IMDS Credentials Outside Of AWS Infrastructure · test · high · {"product":"aws","service":"cloudtrail"}
• Admin User Remote Logon · test · low · {"product":"windows","service":"security","definition":"Requirements: Identifiable administrators usernames (pattern or special unique character. ex: \"Admin-*\"), internal policy mandating use only as secondary account"}
• DMSA Service Account Created in Specific OUs - PowerShell · experimental · medium · {"category":"ps_script","product":"windows"}
• DMSA Link Attributes Modified · experimental · low · {"category":"ps_script","product":"windows"}
• New DMSA Service Account Created in Specific OUs · experimental · medium · {"category":"process_creation","product":"windows"}

Atlas deterministic concepts

No exact concept selected.

Anomaly models

No exact Atlas model in this snapshot.

ATT&CK analytic guidance

DET0210 Abuse of Domain Accounts

AN0590 Analytic 0590

Detection of suspicious logon behavior using valid domain accounts across multiple hosts, off-hours, or simultaneous sessions from geographically distant locations.

AN0591 Analytic 0591

Use of domain accounts via sssd or winbind for logon activity outside of typical patterns, especially on sensitive systems or with lateral movement tools.

AN0592 Analytic 0592

Domain logins using network accounts or mobile accounts via Open Directory or Active Directory plugins, especially outside business hours or on atypical endpoints.

AN0593 Analytic 0593

Login to vSphere or ESXi hosts using domain accounts, especially those associated with vpxuser or unexpected group memberships.