Esc
Local Accounts - T1078.003
(ATT&CK® Technique)
Definition
Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service.
D3FEND Inferred Relationships
Browse the D3FEND knowledge graph by clicking on the nodes below.
graph LR; T1078003["Local Accounts"] --> |uses| UserAccount["User Account"]; class T1078003 OffensiveTechniqueNode; class UserAccount ArtifactNode; click UserAccount href "/dao/artifact/d3f:UserAccount"; click T1078003 href "/offensive-technique/attack/T1078.003/"; click UserAccount href "/dao/artifact/d3f:UserAccount"; T1078003["Local Accounts"] --> |uses| LocalUserAccount["Local User Account"]; class T1078003 OffensiveTechniqueNode; class LocalUserAccount ArtifactNode; click LocalUserAccount href "/dao/artifact/d3f:LocalUserAccount"; click T1078003 href "/offensive-technique/attack/T1078.003/"; click LocalUserAccount href "/dao/artifact/d3f:LocalUserAccount"; LocalAccountMonitoring["Local Account Monitoring"] --> | analyzes | LocalUserAccount["Local User Account"]; LocalAccountMonitoring["Local Account Monitoring"] -.-> | may-detect | T1078003["Local Accounts"] ; class LocalAccountMonitoring DefensiveTechniqueNode; class LocalUserAccount ArtifactNode; click LocalAccountMonitoring href "/technique/d3f:LocalAccountMonitoring"; AccountLocking["Account Locking"] --> | disables | UserAccount["User Account"]; AccountLocking["Account Locking"] -.-> | may-evict | T1078003["Local Accounts"] ; class AccountLocking DefensiveTechniqueNode; class UserAccount ArtifactNode; click AccountLocking href "/technique/d3f:AccountLocking"; AccountLocking["Account Locking"] --> | disables | LocalUserAccount["Local User Account"]; class AccountLocking DefensiveTechniqueNode; class LocalUserAccount ArtifactNode; click AccountLocking href "/technique/d3f:AccountLocking"; RestoreUserAccountAccess["Restore User Account Access"] --> | restores | UserAccount["User Account"]; RestoreUserAccountAccess["Restore User Account Access"] -.-> | may-restore | T1078003["Local Accounts"] ; class RestoreUserAccountAccess DefensiveTechniqueNode; class UserAccount ArtifactNode; click RestoreUserAccountAccess href "/technique/d3f:RestoreUserAccountAccess"; RestoreUserAccountAccess["Restore User Account Access"] --> | restores | LocalUserAccount["Local User Account"]; class RestoreUserAccountAccess DefensiveTechniqueNode; class LocalUserAccount ArtifactNode; click RestoreUserAccountAccess href "/technique/d3f:RestoreUserAccountAccess"; UnlockAccount["Unlock Account"] --> | restores | UserAccount["User Account"]; UnlockAccount["Unlock Account"] -.-> | may-restore | T1078003["Local Accounts"] ; class UnlockAccount DefensiveTechniqueNode; class UserAccount ArtifactNode; click UnlockAccount href "/technique/d3f:UnlockAccount"; UnlockAccount["Unlock Account"] --> | restores | LocalUserAccount["Local User Account"]; class UnlockAccount DefensiveTechniqueNode; class LocalUserAccount ArtifactNode; click UnlockAccount href "/technique/d3f:UnlockAccount"; AgentAuthentication["Agent Authentication"] --> | strengthens | LocalUserAccount["Local User Account"]; AgentAuthentication["Agent Authentication"] -.-> | may-harden | T1078003["Local Accounts"] ; class AgentAuthentication DefensiveTechniqueNode; class LocalUserAccount ArtifactNode; click AgentAuthentication href "/technique/d3f:AgentAuthentication"; UserAccountPermissions["User Account Permissions"] --> | restricts | UserAccount["User Account"]; UserAccountPermissions["User Account Permissions"] -.-> | may-isolate | T1078003["Local Accounts"] ; class UserAccountPermissions DefensiveTechniqueNode; class UserAccount ArtifactNode; click UserAccountPermissions href "/technique/d3f:UserAccountPermissions"; UserAccountPermissions["User Account Permissions"] --> | restricts | LocalUserAccount["Local User Account"]; class UserAccountPermissions DefensiveTechniqueNode; class LocalUserAccount ArtifactNode; click UserAccountPermissions href "/technique/d3f:UserAccountPermissions"; AgentAuthentication["Agent Authentication"] --> | strengthens | UserAccount["User Account"]; class AgentAuthentication DefensiveTechniqueNode; class UserAccount ArtifactNode; click AgentAuthentication href "/technique/d3f:AgentAuthentication";