Xworm Enters Through the Door Follina Left Open

Indicators of Compromise

Notes

<div><b>Conclusions&nbsp;</b></div><div>Malware developers with little or no responsibilities can create malicious programs and sell them on various forums for monetary gain. Threat actors are provided with highly impactful and dangerous features, such as ransomware and HVNC modules to attract more customers. You must have a system in place to keep yourself abreast with TTPs of newly launched threats or if there are new attack techniques adopted by existing cybercriminal groups.</div><div><br></div>

Mitigation

<b>TTP's</b><br><div><div style="font-size: medium;">The adversary is trying to get into your network.</div><div style="font-size: medium;"><br></div><div style="font-size: medium;">Initial Access consists of techniques that use various entry vectors to gain their initial foothold within a network. Techniques used to gain a foothold include targeted spearphishing and exploiting weaknesses on public-facing web servers. Footholds gained through initial access may allow for continued access, like valid accounts and use of external remote services, or may be limited-use due to changing passwords.</div><div style="font-size: medium;"><br></div><div><b>Techniques</b></div><div><h6 class="table-object-count" style="box-sizing: border-box; line-height: 1.2; font-size: 1rem; letter-spacing: normal; margin-top: 0px; margin-bottom: 0.5rem; display: flex; justify-content: flex-end; color: rgb(57, 67, 76); font-family: Roboto-Regular, sans-serif;">Techniques: 9</h6><table class="table-techniques" style="box-sizing: border-box; font-size: 16px; border-collapse: collapse; color: rgb(57, 67, 76); font-family: Roboto-Regular, sans-serif;"><thead style="box-sizing: border-box;"><tr style="box-sizing: border-box; background: rgb(242, 242, 242); border-bottom: 1px solid rgb(223, 223, 223);"><td colspan="2" style="box-sizing: border-box; vertical-align: top; padding: 10px; border: 1px solid rgb(223, 223, 223);">ID</td><td style="box-sizing: border-box; vertical-align: top; padding: 10px; border: 1px solid rgb(223, 223, 223);">Name</td><td style="box-sizing: border-box; vertical-align: top; padding: 10px; border: 1px solid rgb(223, 223, 223);">Description</td></tr></thead><tbody style="box-sizing: border-box;"><tr class="technique" style="box-sizing: border-box;"><td colspan="2" style="box-sizing: border-box; vertical-align: top; padding: 10px; border-top: 1px solid rgb(223, 223, 223); border-right: 1px solid rgb(223, 223, 223); border-bottom: none; border-left: 1px solid rgb(223, 223, 223); border-image: initial; color: rgb(79, 124, 172);"><a href="https://attack.mitre.org/techniques/T1189" style="box-sizing: border-box; color: rgb(79, 124, 172); background-color: transparent;">T1189</a></td><td style="box-sizing: border-box; vertical-align: top; padding: 10px; border: 1px solid rgb(223, 223, 223); color: rgb(79, 124, 172);"><a href="https://attack.mitre.org/techniques/T1189" style="box-sizing: border-box; color: rgb(79, 124, 172); background-color: transparent;">Drive-by Compromise</a></td><td style="box-sizing: border-box; vertical-align: top; padding: 10px; border: 1px solid rgb(223, 223, 223);">Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is typically targeted for exploitation, but adversaries may also use compromised websites for non-exploitation behavior such as acquiring&nbsp;<a href="https://attack.mitre.org/techniques/T1550/001" style="box-sizing: border-box; color: rgb(79, 124, 172); background-color: transparent;">Application Access Token</a>.</td></tr><tr class="technique" style="box-sizing: border-box;"><td colspan="2" style="box-sizing: border-box; vertical-align: top; padding: 10px; border-top: 1px solid rgb(223, 223, 223); border-right: 1px solid rgb(223, 223, 223); border-bottom: none; border-left: 1px solid rgb(223, 223, 223); border-image: initial; color: rgb(79, 124, 172);"><a href="https://attack.mitre.org/techniques/T1190" style="box-sizing: border-box; color: rgb(79, 124, 172); background-color: transparent;">T1190</a></td><td style="box-sizing: border-box; vertical-align: top; padding: 10px; border: 1px solid rgb(223, 223, 223); color: rgb(79, 124, 172);"><a href="https://attack.mitre.org/techniques/T1190" style="box-sizing: border-box; color: rgb(79, 124, 172); background-color: transparent;">Exploit Public-Facing Application</a></td><td style="box-sizing: border-box; vertical-align: top; padding: 10px; border: 1px solid rgb(223, 223, 223);">Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.</td></tr><tr class="technique" style="box-sizing: border-box;"><td colspan="2" style="box-sizing: border-box; vertical-align: top; padding: 10px; border-top: 1px solid rgb(223, 223, 223); border-right: 1px solid rgb(223, 223, 223); border-bottom: none; border-left: 1px solid rgb(223, 223, 223); border-image: initial; color: rgb(79, 124, 172);"><a href="https://attack.mitre.org/techniques/T1133" style="box-sizing: border-box; color: rgb(79, 124, 172); background-color: transparent;">T1133</a></td><td style="box-sizing: border-box; vertical-align: top; padding: 10px; border: 1px solid rgb(223, 223, 223); color: rgb(79, 124, 172);"><a href="https://attack.mitre.org/techniques/T1133" style="box-sizing: border-box; color: rgb(79, 124, 172); background-color: transparent;">External Remote Services</a></td><td style="box-sizing: border-box; vertical-align: top; padding: 10px; border: 1px solid rgb(223, 223, 223);">Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as&nbsp;<a href="https://attack.mitre.org/techniques/T1021/006" style="box-sizing: border-box; color: rgb(79, 124, 172); background-color: transparent;">Windows Remote Management</a>&nbsp;and&nbsp;<a href="https://attack.mitre.org/techniques/T1021/005" style="box-sizing: border-box; color: rgb(79, 124, 172); background-color: transparent;">VNC</a>&nbsp;can also be used externally.</td></tr><tr class="technique" style="box-sizing: border-box;"><td colspan="2" style="box-sizing: border-box; vertical-align: top; padding: 10px; border-top: 1px solid rgb(223, 223, 223); border-right: 1px solid rgb(223, 223, 223); border-bottom: none; border-left: 1px solid rgb(223, 223, 223); border-image: initial; color: rgb(79, 124, 172);"><a href="https://attack.mitre.org/techniques/T1200" style="box-sizing: border-box; color: rgb(79, 124, 172); background-color: transparent;">T1200</a></td><td style="box-sizing: border-box; vertical-align: top; padding: 10px; border: 1px solid rgb(223, 223, 223); color: rgb(79, 124, 172);"><a href="https://attack.mitre.org/techniques/T1200" style="box-sizing: border-box; color: rgb(79, 124, 172); background-color: transparent;">Hardware Additions</a></td><td style="box-sizing: border-box; vertical-align: top; padding: 10px; border: 1px solid rgb(223, 223, 223);">Adversaries may introduce computer accessories, networking hardware, or other computing devices into a system or network that can be used as a vector to gain access. Rather than just connecting and distributing payloads via removable storage (i.e.&nbsp;<a href="https://attack.mitre.org/techniques/T1091" style="box-sizing: border-box; color: rgb(79, 124, 172); background-color: transparent;">Replication Through Removable Media</a>), more robust hardware additions can be used to introduce new functionalities and/or features into a system that can then be abused.</td></tr><tr class="technique" style="box-sizing: border-box;"><td colspan="2" style="box-sizing: border-box; vertical-align: top; padding: 10px; border-top: 1px solid rgb(223, 223, 223); border-right: 1px solid rgb(223, 223, 223); border-bottom: none; border-left: 1px solid rgb(223, 223, 223); border-image: initial; color: rgb(79, 124, 172);"><a href="https://attack.mitre.org/techniques/T1566" style="box-sizing: border-box; color: rgb(79, 124, 172); background-color: transparent;">T1566</a></td><td style="box-sizing: border-box; vertical-align: top; padding: 10px; border: 1px solid rgb(223, 223, 223); color: rgb(79, 124, 172);"><a href="https://attack.mitre.org/techniques/T1566" style="box-sizing: border-box; color: rgb(79, 124, 172); background-color: transparent;">Phishing</a></td><td style="box-sizing: border-box; vertical-align: top; padding: 10px; border: 1px solid rgb(223, 223, 223);">Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns.</td></tr><tr class="sub technique" style="box-sizing: border-box; border-left: none;"><td style="box-sizing: border-box; vertical-align: top; padding: 10px; border-top: none; border-right: 1px solid rgb(223, 223, 223); border-bottom: none; border-left: 1px solid rgb(223, 223, 223); border-image: initial; width: 5ex; color: rgb(79, 124, 172);"></td><td style="box-sizing: border-box; vertical-align: top; padding: 10px; border: 1px solid rgb(223, 223, 223); color: rgb(79, 124, 172);"><a href="https://attack.mitre.org/techniques/T1566/001" style="box-sizing: border-box; color: rgb(79, 124, 172); background-color: transparent;">.001</a></td><td style="box-sizing: border-box; vertical-align: top; padding: 10px; border: 1px solid rgb(223, 223, 223); color: rgb(79, 124, 172);"><a href="https://attack.mitre.org/techniques/T1566/001" style="box-sizing: border-box; color: rgb(79, 124, 172); background-color: transparent;">Spearphishing Attachment</a></td><td style="box-sizing: border-box; vertical-align: top; padding: 10px; border: 1px solid rgb(223, 223, 223);">Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems. Spearphishing attachment is a specific variant of spearphishing. Spearphishing attachment is different from other forms of spearphishing in that it employs the use of malware attached to an email. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries attach a file to the spearphishing email and usually rely upon&nbsp;<a href="https://attack.mitre.org/techniques/T1204" style="box-sizing: border-box; color: rgb(79, 124, 172); background-color: transparent;">User Execution</a>&nbsp;to gain execution. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.</td></tr><tr class="sub technique" style="box-sizing: border-box; border-left: none;"><td style="box-sizing: border-box; vertical-align: top; padding: 10px; border-top: none; border-right: 1px solid rgb(223, 223, 223); border-bottom: none; border-left: 1px solid rgb(223, 223, 223); border-image: initial; width: 5ex; color: rgb(79, 124, 172);"></td><td style="box-sizing: border-box; vertical-align: top; padding: 10px; border: 1px solid rgb(223, 223, 223); color: rgb(79, 124, 172);"><a href="https://attack.mitre.org/techniques/T1566/002" style="box-sizing: border-box; color: rgb(79, 124, 172); background-color: transparent;">.002</a></td><td style="box-sizing: border-box; vertical-align: top; padding: 10px; border: 1px solid rgb(223, 223, 223); color: rgb(79, 124, 172);"><a href="https://attack.mitre.org/techniques/T1566/002" style="box-sizing: border-box; color: rgb(79, 124, 172); background-color: transparent;">Spearphishing Link</a></td><td style="box-sizing: border-box; vertical-align: top; padding: 10px; border: 1px solid rgb(223, 223, 223);">Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.</td></tr><tr class="sub technique" style="box-sizing: border-box; border-left: none;"><td style="box-sizing: border-box; vertical-align: top; padding: 10px; border-top: none; border-right: 1px solid rgb(223, 223, 223); border-bottom: none; border-left: 1px solid rgb(223, 223, 223); border-image: initial; width: 5ex; color: rgb(79, 124, 172);"></td><td style="box-sizing: border-box; vertical-align: top; padding: 10px; border: 1px solid rgb(223, 223, 223); color: rgb(79, 124, 172);"><a href="https://attack.mitre.org/techniques/T1566/003" style="box-sizing: border-box; color: rgb(79, 124, 172); background-color: transparent;">.003</a></td><td style="box-sizing: border-box; vertical-align: top; padding: 10px; border: 1px solid rgb(223, 223, 223); color: rgb(79, 124, 172);"><a href="https://attack.mitre.org/techniques/T1566/003" style="box-sizing: border-box; color: rgb(79, 124, 172); background-color: transparent;">Spearphishing via Service</a></td><td style="box-sizing: border-box; vertical-align: top; padding: 10px; border: 1px solid rgb(223, 223, 223);">Adversaries may send spearphishing messages via third-party services in an attempt to gain access to victim systems. Spearphishing via service is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of third party services rather than directly via enterprise email channels.</td></tr><tr class="technique" style="box-sizing: border-box;"><td colspan="2" style="box-sizing: border-box; vertical-align: top; padding: 10px; border-top: 1px solid rgb(223, 223, 223); border-right: 1px solid rgb(223, 223, 223); border-bottom: none; border-left: 1px solid rgb(223, 223, 223); border-image: initial; color: rgb(79, 124, 172);"><a href="https://attack.mitre.org/techniques/T1091" style="box-sizing: border-box; color: rgb(79, 124, 172); background-color: transparent;">T1091</a></td><td style="box-sizing: border-box; vertical-align: top; padding: 10px; border: 1px solid rgb(223, 223, 223); color: rgb(79, 124, 172);"><a href="https://attack.mitre.org/techniques/T1091" style="box-sizing: border-box; color: rgb(79, 124, 172); background-color: transparent;">Replication Through Removable Media</a></td><td style="box-sizing: border-box; vertical-align: top; padding: 10px; border: 1px solid rgb(223, 223, 223);">Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.</td></tr><tr class="technique" style="box-sizing: border-box;"><td colspan="2" style="box-sizing: border-box; vertical-align: top; padding: 10px; border-top: 1px solid rgb(223, 223, 223); border-right: 1px solid rgb(223, 223, 223); border-bottom: none; border-left: 1px solid rgb(223, 223, 223); border-image: initial; color: rgb(79, 124, 172);"><a href="https://attack.mitre.org/techniques/T1195" style="box-sizing: border-box; color: rgb(79, 124, 172); background-color: transparent;">T1195</a></td><td style="box-sizing: border-box; vertical-align: top; padding: 10px; border: 1px solid rgb(223, 223, 223); color: rgb(79, 124, 172);"><a href="https://attack.mitre.org/techniques/T1195" style="box-sizing: border-box; color: rgb(79, 124, 172); background-color: transparent;">Supply Chain Compromise</a></td><td style="box-sizing: border-box; vertical-align: top; padding: 10px; border: 1px solid rgb(223, 223, 223);">Adversaries may manipulate products or product delivery mechanisms prior to receipt by a final consumer for the purpose of data or system compromise.</td></tr><tr class="sub technique" style="box-sizing: border-box; border-left: none;"><td style="box-sizing: border-box; vertical-align: top; padding: 10px; border-top: none; border-right: 1px solid rgb(223, 223, 223); border-bottom: none; border-left: 1px solid rgb(223, 223, 223); border-image: initial; width: 5ex; color: rgb(79, 124, 172);"></td><td style="box-sizing: border-box; vertical-align: top; padding: 10px; border: 1px solid rgb(223, 223, 223); color: rgb(79, 124, 172);"><a href="https://attack.mitre.org/techniques/T1195/001" style="box-sizing: border-box; color: rgb(79, 124, 172); background-color: transparent;">.001</a></td><td style="box-sizing: border-box; vertical-align: top; padding: 10px; border: 1px solid rgb(223, 223, 223); color: rgb(79, 124, 172);"><a href="https://attack.mitre.org/techniques/T1195/001" style="box-sizing: border-box; color: rgb(79, 124, 172); background-color: transparent;">Compromise Software Dependencies and Development Tools</a></td><td style="box-sizing: border-box; vertical-align: top; padding: 10px; border: 1px solid rgb(223, 223, 223);">Adversaries may manipulate software dependencies and development tools prior to receipt by a final consumer for the purpose of data or system compromise. Applications often depend on external software to function properly. Popular open source projects that are used as dependencies in many applications may be targeted as a means to add malicious code to users of the dependency.</td></tr><tr class="sub technique" style="box-sizing: border-box; border-left: none;"><td style="box-sizing: border-box; vertical-align: top; padding: 10px; border-top: none; border-right: 1px solid rgb(223, 223, 223); border-bottom: none; border-left: 1px solid rgb(223, 223, 223); border-image: initial; width: 5ex; color: rgb(79, 124, 172);"></td><td style="box-sizing: border-box; vertical-align: top; padding: 10px; border: 1px solid rgb(223, 223, 223); color: rgb(79, 124, 172);"><a href="https://attack.mitre.org/techniques/T1195/002" style="box-sizing: border-box; color: rgb(79, 124, 172); background-color: transparent;">.002</a></td><td style="box-sizing: border-box; vertical-align: top; padding: 10px; border: 1px solid rgb(223, 223, 223); color: rgb(79, 124, 172);"><a href="https://attack.mitre.org/techniques/T1195/002" style="box-sizing: border-box; color: rgb(79, 124, 172); background-color: transparent;">Compromise Software Supply Chain</a></td><td style="box-sizing: border-box; vertical-align: top; padding: 10px; border: 1px solid rgb(223, 223, 223);">Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise of software can take place in a number of ways, including manipulation of the application source code, manipulation of the update/distribution mechanism for that software, or replacing compiled releases with a modified version.</td></tr><tr class="sub technique" style="box-sizing: border-box; border-left: none;"><td style="box-sizing: border-box; vertical-align: top; padding: 10px; border-top: none; border-right: 1px solid rgb(223, 223, 223); border-bottom: none; border-left: 1px solid rgb(223, 223, 223); border-image: initial; width: 5ex; color: rgb(79, 124, 172);"></td><td style="box-sizing: border-box; vertical-align: top; padding: 10px; border: 1px solid rgb(223, 223, 223); color: rgb(79, 124, 172);"><a href="https://attack.mitre.org/techniques/T1195/003" style="box-sizing: border-box; color: rgb(79, 124, 172); background-color: transparent;">.003</a></td><td style="box-sizing: border-box; vertical-align: top; padding: 10px; border: 1px solid rgb(223, 223, 223); color: rgb(79, 124, 172);"><a href="https://attack.mitre.org/techniques/T1195/003" style="box-sizing: border-box; color: rgb(79, 124, 172); background-color: transparent;">Compromise Hardware Supply Chain</a></td><td style="box-sizing: border-box; vertical-align: top; padding: 10px; border: 1px solid rgb(223, 223, 223);">Adversaries may manipulate hardware components in products prior to receipt by a final consumer for the purpose of data or system compromise. By modifying hardware or firmware in the supply chain, adversaries can insert a backdoor into consumer networks that may be difficult to detect and give the adversary a high degree of control over the system. Hardware backdoors may be inserted into various devices, such as servers, workstations, network infrastructure, or peripherals.</td></tr><tr class="technique" style="box-sizing: border-box;"><td colspan="2" style="box-sizing: border-box; vertical-align: top; padding: 10px; border-top: 1px solid rgb(223, 223, 223); border-right: 1px solid rgb(223, 223, 223); border-bottom: none; border-left: 1px solid rgb(223, 223, 223); border-image: initial; color: rgb(79, 124, 172);"><a href="https://attack.mitre.org/techniques/T1199" style="box-sizing: border-box; color: rgb(79, 124, 172); background-color: transparent;">T1199</a></td><td style="box-sizing: border-box; vertical-align: top; padding: 10px; border: 1px solid rgb(223, 223, 223); color: rgb(79, 124, 172);"><a href="https://attack.mitre.org/techniques/T1199" style="box-sizing: border-box; color: rgb(79, 124, 172); background-color: transparent;">Trusted Relationship</a></td><td style="box-sizing: border-box; vertical-align: top; padding: 10px; border: 1px solid rgb(223, 223, 223);">Adversaries may breach or otherwise leverage organizations who have access to intended victims. Access through trusted third party relationship abuses an existing connection that may not be protected or receives less scrutiny than standard mechanisms of gaining access to a network.</td></tr><tr class="technique" style="box-sizing: border-box;"><td colspan="2" style="box-sizing: border-box; vertical-align: top; padding: 10px; border-top: 1px solid rgb(223, 223, 223); border-right: 1px solid rgb(223, 223, 223); border-bottom: none; border-left: 1px solid rgb(223, 223, 223); border-image: initial; color: rgb(79, 124, 172);"><a href="https://attack.mitre.org/techniques/T1078" style="box-sizing: border-box; color: rgb(79, 124, 172); background-color: transparent;">T1078</a></td><td style="box-sizing: border-box; vertical-align: top; padding: 10px; border: 1px solid rgb(223, 223, 223); color: rgb(79, 124, 172);"><a href="https://attack.mitre.org/techniques/T1078" style="box-sizing: border-box; color: rgb(79, 124, 172); background-color: transparent;">Valid Accounts</a></td><td style="box-sizing: border-box; vertical-align: top; padding: 10px; border: 1px solid rgb(223, 223, 223);">Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.</td></tr><tr class="sub technique" style="box-sizing: border-box; border-left: none;"><td style="box-sizing: border-box; vertical-align: top; padding: 10px; border-top: none; border-right: 1px solid rgb(223, 223, 223); border-bottom: none; border-left: 1px solid rgb(223, 223, 223); border-image: initial; width: 5ex; color: rgb(79, 124, 172);"></td><td style="box-sizing: border-box; vertical-align: top; padding: 10px; border: 1px solid rgb(223, 223, 223); color: rgb(79, 124, 172);"><a href="https://attack.mitre.org/techniques/T1078/001" style="box-sizing: border-box; color: rgb(79, 124, 172); background-color: transparent;">.001</a></td><td style="box-sizing: border-box; vertical-align: top; padding: 10px; border: 1px solid rgb(223, 223, 223); color: rgb(79, 124, 172);"><a href="https://attack.mitre.org/techniques/T1078/001" style="box-sizing: border-box; color: rgb(79, 124, 172); background-color: transparent;">Default Accounts</a></td><td style="box-sizing: border-box; vertical-align: top; padding: 10px; border: 1px solid rgb(223, 223, 223);">Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems. Default accounts also include default factory/provider set accounts on other types of systems, software, or devices, including the root user account in AWS and the default service account in Kubernetes.</td></tr><tr class="sub technique" style="box-sizing: border-box; border-left: none;"><td style="box-sizing: border-box; vertical-align: top; padding: 10px; border-top: none; border-right: 1px solid rgb(223, 223, 223); border-bottom: none; border-left: 1px solid rgb(223, 223, 223); border-image: initial; width: 5ex; color: rgb(79, 124, 172);"></td><td style="box-sizing: border-box; vertical-align: top; padding: 10px; border: 1px solid rgb(223, 223, 223); color: rgb(79, 124, 172);"><a href="https://attack.mitre.org/techniques/T1078/002" style="box-sizing: border-box; color: rgb(79, 124, 172); background-color: transparent;">.002</a></td><td style="box-sizing: border-box; vertical-align: top; padding: 10px; border: 1px solid rgb(223, 223, 223); color: rgb(79, 124, 172);"><a href="https://attack.mitre.org/techniques/T1078/002" style="box-sizing: border-box; color: rgb(79, 124, 172); background-color: transparent;">Domain Accounts</a></td><td style="box-sizing: border-box; vertical-align: top; padding: 10px; border: 1px solid rgb(223, 223, 223);">Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover users, administrators, and services.</td></tr><tr class="sub technique" style="box-sizing: border-box; border-left: none;"><td style="box-sizing: border-box; vertical-align: top; padding: 10px; border-top: none; border-right: 1px solid rgb(223, 223, 223); border-bottom: none; border-left: 1px solid rgb(223, 223, 223); border-image: initial; width: 5ex; color: rgb(79, 124, 172);"></td><td style="box-sizing: border-box; vertical-align: top; padding: 10px; border: 1px solid rgb(223, 223, 223); color: rgb(79, 124, 172);"><a href="https://attack.mitre.org/techniques/T1078/003" style="box-sizing: border-box; color: rgb(79, 124, 172); background-color: transparent;">.003</a></td><td style="box-sizing: border-box; vertical-align: top; padding: 10px; border: 1px solid rgb(223, 223, 223); color: rgb(79, 124, 172);"><a href="https://attack.mitre.org/techniques/T1078/003" style="box-sizing: border-box; color: rgb(79, 124, 172); background-color: transparent;">Local Accounts</a></td><td style="box-sizing: border-box; vertical-align: top; padding: 10px; border: 1px solid rgb(223, 223, 223);">Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service.</td></tr><tr class="sub technique" style="box-sizing: border-box; border-bottom: 1px solid rgb(223, 223, 223); border-left: none;"><td style="box-sizing: border-box; vertical-align: top; padding: 10px; border-top: none; border-right: 1px solid rgb(223, 223, 223); border-bottom: none; border-left: 1px solid rgb(223, 223, 223); border-image: initial; width: 5ex; color: rgb(79, 124, 172);"></td><td style="box-sizing: border-box; vertical-align: top; padding: 10px; border: 1px solid rgb(223, 223, 223); color: rgb(79, 124, 172);"><a href="https://attack.mitre.org/techniques/T1078/004" style="box-sizing: border-box; color: rgb(79, 124, 172); background-color: transparent;">.004</a></td><td style="box-sizing: border-box; vertical-align: top; padding: 10px; border: 1px solid rgb(223, 223, 223); color: rgb(79, 124, 172);"><a href="https://attack.mitre.org/techniques/T1078/004" style="box-sizing: border-box; color: rgb(79, 124, 172); background-color: transparent;">Cloud Accounts</a></td><td style="box-sizing: border-box; vertical-align: top; padding: 10px; border: 1px solid rgb(223, 223, 223);">Adversaries may obtain and abuse credentials of a cloud account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. In some cases, cloud accounts may be federated with traditional identity management systems, such as Windows Active Directory.</td></tr></tbody></table></div></div>