1200KM / simulation
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.…
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.[volexity_0day_sophos_FW] Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
In some cases, adversaries may abuse inactive accounts: for example, those belonging to individuals who are no longer part of an organization. Using these accounts may allow the adversary to evade detection, as the original account user will not be present to identify any anomalous activity taking place on their account.[CISA MFA PrintNightmare]
The overlap of permissions for local, domain, and cloud accounts across a network of systems is of concern because the adversary may be able to pivot across accounts and systems to reach a high level of access (i.e., domain or enterprise administrator) to bypass access controls set within the enterprise.[TechNet Credential Theft]
Official technique definition · Open in the interactive matrix
Related pages are navigation context. Their tools, rules and lab results are not automatically inherited.
These contracts are selected through exact technique-to-data-component relationships or explicitly labelled planning overrides. Configure a collector at the relevant observation point; a telemetry name alone is not coverage.
DC0067 collection page — Enable Audit Logon and collect successful session creation on the receiving host; join session/logon IDs rather than only account names.
Required normalized fields: account, logon_id, logon_type, source_ip.
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0067",
"collector": "illustrative-lab-collector",
"observation": {
"account": "LAB\\analyst",
"logon_id": "0x12345",
"logon_type": 3,
"source_ip": "192.0.2.10"
}
}Visibility limits: A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.
DC0088 collection page — Collect supported session inventory and correlate session IDs with authentication, logon and logoff events.
Required normalized fields: session_id, account, host, session_type.
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0088",
"collector": "illustrative-lab-collector",
"observation": {
"session_id": "lab-session-1",
"account": "LAB\\analyst",
"host": "lab-host-1",
"session_type": "interactive"
}
}Visibility limits: Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.
DC0032 collection page — Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.
Required normalized fields: process_guid, image, parent_image, command_line, user.
<EventFiltering>
<ProcessCreate onmatch="include">
<Image condition="is">C:\Windows\System32\whoami.exe</Image>
</ProcessCreate>
</EventFiltering>This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>.
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0032",
"collector": "illustrative-lab-collector",
"observation": {
"process_guid": "lab-process-001",
"image": "C:\\Windows\\System32\\whoami.exe",
"parent_image": "C:\\Windows\\System32\\cmd.exe",
"command_line": "whoami",
"user": "LAB\\analyst"
}
}Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.
DC0002 collection page — Collect successful and failed sign-ins, authentication method, application and conditional-access context; distinguish account validation from session creation.
Required normalized fields: account, application, result, reason, source_ip.
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0002",
"collector": "illustrative-lab-collector",
"observation": {
"account": "analyst@example.test",
"application": "lab-portal",
"result": "failure",
"reason": "invalid_credential",
"source_ip": "192.0.2.10"
}
}Visibility limits: A token creation record is not evidence of token use; a sign-in is not a complete record of every resource access. Some provider-side data is unavailable to the customer.
Open the dedicated detection workspace · Existing query engineering
Detection of compromised or misused valid accounts via anomalous logon patterns, abnormal logon types, and inconsistent geographic or time-based activity across Windows endpoints.
Platforms: Windows.
Detection of valid account misuse through SSH logins, sudo/su abuse, and service account anomalies outside expected patterns.
Platforms: Linux.
Detection of interactive and remote logins by service accounts or users at unusual times, with unexpected child process activity.
Platforms: macOS.
Detection of valid account abuse in IdP logs via geographic anomalies, impossible travel, risky sign-ins, and multiple MFA attempts or failures.
Platforms: Identity Provider.
Detection of containerized service accounts or compromised kubeconfigs being used for cluster access from unexpected nodes or IPs.
Platforms: Containers.
55 exact-tagged source rules. A source tag is a discovery aid, not a relevance verdict. Check the observation point and actual condition of each rule.
MATCH(successful_login) AND source_country IN blocked_countries -> ALERT; COUNT(failed_login BY account, 10m) >= threshold FOLLOWED_BY successful_login WITHIN 10m -> ALERTSelf-Baseline Anomaly · Peer-Group Anomaly · Temporal-Context Anomaly · Multivariate Combination Anomaly
Start from the exact analytic above. The collection-specific lenses below are analyst recommendations; they do not assert that an arbitrary statistical deviation detects this technique.
Anomaly Detection Atlas · Baseline, validation and blind spots
No reviewed lab-tool association is selected for this exact technique. This is a curation gap, not a statement that no tool can implement the behavior.
These are exact ATT&CK software-use relationships, including malware. They provide behavior context, not recommendations to download or execute malware. No safety or detector claim is inherited.
Adversaries can instruct Duqu to spread laterally by copying itself to shares it has enumerated and for which it has obtained legitimate credentials (via keylogging or other means). The remote host is then infected by using the compromised credentials to schedule a task on remote machines that executes the malware.[Symantec W32.Duqu]
Exact relationship: relationship--448a35fc-fecf-4373-9888-30c37dd1d56aSome SeaDuke samples have a module to extract email from Microsoft Exchange servers using compromised credentials.[Symantec Seaduke 2015]
Exact relationship: relationship--32864e94-8581-4f77-bf7d-53aaf3710f60Linux Rabbit acquires valid SSH accounts through brute force. [Anomali Linux Rabbit 2018]
Exact relationship: relationship--e5ba408f-92d3-404a-b3e1-adcd5d21bc5fDtrack used hard-coded credentials to gain access to a network share.[CyberBit Dtrack]
Exact relationship: relationship--3916c36b-bd92-4070-bc9a-6eab3d78cabdKinsing has used valid SSH credentials to access remote hosts.[Aqua Kinsing April 2020]
Exact relationship: relationship--13ebbab5-204d-4a61-9ee4-378346626371Industroyer can use supplied user credentials to execute processes and stop services.[ESET Industroyer]
Exact relationship: relationship--3ce056f2-7ade-4557-86a8-f0ec216730ecLP-Notes has used stolen Windows credentials to log in as the users.[ESET_MuddyWater_Dec2025]
Exact relationship: relationship--34bd47fc-20f7-487f-a5af-9cd60cdd3428Atomic evidence: no compatible candidate in this snapshot. Live lab status: not run for these imported procedures.
Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.
No compatible Atomic procedure is present in this pinned evidence set. Technical feasibility has not been ruled out. A custom procedure must define the behavior, target, collection point, success observable and rollback before execution.
Download synthetic collection fixture (JSON) · Download the complete engineering workbook
This fixture exercises the listed collection fields. It does not reproduce Valid Accounts, label its example events as malicious, or measure detection effectiveness. Use the exact analytic and selected procedure to build an independently labelled behavior-positive dataset.
Not run in this browser. No network scan or attack command is executed by this control.
All-page audit and evidence inventory · This page’s machine-readable workbook
Pinned MITRE STIX source · SHA-256 81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352. Definition and procedure context are reproduced from this snapshot, not independently re-investigated incidents.
Ensure that applications do not store sensitive data or credentials insecurely. (e.g. plaintext credentials in code, published credentials in repositories, or credentials in public cloud storage).
Disable legacy authentication, which does not support MFA, and require the use of modern authentication protocols instead.
Applications may send push notifications to verify a login as a form of multi-factor authentication (MFA). Train users to only accept valid push notifications and to report suspicious push notifications.
Regularly audit user accounts for activity and deactivate or remove any that are no longer needed.
Audit domain and local accounts as well as their permission levels routinely to look for situations that could allow an adversary to gain wide access by obtaining credentials of a privileged account. [TechNet Credential Theft] [TechNet Least Privilege] These audits should also include if default accounts have been enabled, or if new local accounts are created that have not been authorized. Follow best practices for design and administration of an enterprise network to limit privileged account use across administrative tiers. [Microsoft Securing Privileged Access]
Applications and appliances that utilize default username and password should be changed immediately after the installation, and before deployment to a production environment.[US-CERT Alert TA13-175A Risks of Default Passwords on the Internet] When possible, applications that use SSH keys should be updated periodically and properly secured.
Policies should minimize (if not eliminate) reuse of passwords between different user accounts, especially employees using the same credentials for personal accounts that may not be defended by enterprise security resources.
Implement multi-factor authentication (MFA) across all account types, including default, local, domain, and cloud accounts, to prevent unauthorized access, even if credentials are compromised. MFA provides a critical layer of security by requiring multiple forms of verification beyond just a password. This measure significantly reduces the risk of adversaries abusing valid accounts to gain initial access, escalate privileges, maintain persistence, or evade defenses within your network.
Use conditional access policies to block logins from non-compliant devices or from outside defined organization IP ranges.[Microsoft Common Conditional Access Policies]
No reviewed association in this snapshot.
These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.
Curated research views reached through an exact source technique, a catalog model, or a reviewed collection reference. These are navigation associations, not claims of detector effectiveness or sensor equivalence.
Telemetry contracts · Maintained query examples · Validation and blind spots
Pinned research references. No browser attack runner or production-validated detector is asserted. Imported procedures remain unvalidated; any bounded lab evidence has its own scope. ATT&CK / Atomic provenance · Detection provenance.