Domain Accounts (T1078.002) is the sub-technique of Valid Accounts that targets accounts managed by Active Directory Domain Services. MITRE lists the tactics stealth, persistence, privilege escalation and initial access, and the platforms ESXi, Linux, macOS and Windows.
How attackers use it
MITRE explains that domain accounts are the ones whose access and permissions are configured across all systems and services in the domain. They cover users, administrators and services. Adversaries may compromise them, some with a high level of privilege, through methods such as OS credential dumping or password reuse. That gives access to privileged resources throughout the domain.
Since one account works on many machines, a single theft can open a lot of doors.
How to detect it
MITRE's strategy (DET0210) points to these signals:
- Windows: suspicious logon behavior with valid domain accounts across multiple hosts, off hours, or as simultaneous sessions from geographically distant places.
- Linux: domain accounts used through sssd or winbind outside typical patterns, especially on sensitive systems or alongside lateral movement.
- macOS: network or mobile accounts through Open Directory or Active Directory plugins, especially outside business hours or on atypical endpoints.
- ESXi: logins to vSphere or ESXi hosts with domain accounts, especially those linked to vpxuser or with unexpected group memberships.
Collect domain controller logon events and endpoint authentication logs, and build a baseline of which accounts sign in where.
How to reduce the risk
MITRE's mitigations, in plain steps:
- Integrate multi-factor authentication into policy. It reduces the chance of an adversary using stolen credentials, and can also restrict access to cloud resources and APIs.
- Enforce password policies for domain accounts so that passwords are complex, unique and rotated, which cuts down guessing and credential stuffing.
- Audit domain account permissions routinely. Avoid placing user or admin domain accounts in local administrator groups across systems unless tightly controlled and segmented, since that is close to having the same local admin password everywhere. Limit credential overlap across systems and across administrative tiers.
- Review domain accounts regularly, and disable or remove inactive ones.
- Train users to accept only valid push notifications and to report suspicious ones.
Check your own environment
- Which domain accounts sit in local administrator groups on many machines?
- Which accounts are enabled but unused for months?
- Are privileged accounts used only on the systems at their own tier?
On Windows, a read-only look at who is in the Domain Admins group, from a domain joined machine with the AD tools:
net group "Domain Admins" /domain
Quick check
Why does MITRE caution against putting domain accounts in local administrator groups widely?
It is often equivalent to having the same local administrator account and password on every system, so one stolen credential reaches many machines.
Sources
- MITRE ATT&CK, T1078.002 Domain Accounts: https://attack.mitre.org/techniques/T1078/002/
