Local Accounts (T1078.003) are accounts configured on a single system or service, for users, remote support, services or administration. MITRE places abuse of them under stealth, persistence, privilege escalation and initial access. Platforms: Containers, ESXi, Linux, macOS, Network Devices and Windows.
How attackers use it
MITRE says adversaries may obtain and abuse local account credentials to gain access, persist, escalate or evade defenses. Local accounts may also be abused to elevate privileges and harvest more credentials through OS credential dumping.
The bigger risk is reuse. MITRE notes that password reuse may allow local accounts to be abused across a set of machines for privilege escalation and lateral movement. If every workstation shares one local administrator password, stealing it once opens them all.
How to detect it
MITRE's strategy (DET0407) lists three analytics:
- Windows: anomalous use of local accounts to log in, especially accounts not typically used interactively or outside business hours.
- Linux and similar systems: interactive or service logins from local accounts outside the expected operational context or at anomalous times.
- Remote access: abnormal or rare logins with local accounts through system or remote mechanisms such as SSH.
Rarity is the key. Most local accounts should have a boring login history, so a first login in months is worth a look.
How to reduce the risk
- Enable multi-factor authentication for local accounts where you can, using mobile authenticators or hardware tokens, even without domain controllers or cloud services (Multi-factor Authentication).
- Make sure local administrator accounts have complex, unique passwords on every system (Password Policies).
- Audit local account permissions routinely, and avoid using local administrator accounts for day to day work. MITRE suggests implementing LAPS to prevent reuse of local administrator credentials across a domain. For Kubernetes, audit service accounts and avoid automatically granting API access when it is not needed (Privileged Account Management).
- Remove inactive or unused local accounts (User Account Management).
Check your own environment
- Is a local administrator password manager such as LAPS in place for Windows machines?
- Do Kubernetes pods get service account tokens they never use?
- Which local accounts exist on servers that nobody can explain?
On Linux, a read-only list of accounts that have a login shell:
grep -v -E 'nologin|false' /etc/passwd
Quick check
What does MITRE suggest to stop reuse of local administrator passwords across a domain?
Implementing LAPS, along with unique complex passwords for local administrator accounts on every system.
Sources
- MITRE ATT&CK, T1078.003 Local Accounts: https://attack.mitre.org/techniques/T1078/003/
