TA0001 · INITIAL ACCESS
Valid Accounts
Logging in with legitimate stolen credentials — the quietest way in and the hardest to distinguish from normal work.
Detect it with
Impossible travel, first-time ASN or country for the user, MFA fatigue patterns, logins outside the user's baseline hours.
Why it matters on shift
Valid Accounts is one of the concrete ways adversaries achieve initial access. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After initial access, the next tactic is usually Execution. Search your telemetry for the transition before closing the ticket.
4 sub-techniques
How it shows up in practice
- T1078.001
Default Accounts
Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
- T1078.002
Domain Accounts
Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
- T1078.003
Local Accounts
Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
- T1078.004
Cloud Accounts
Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
Kill-chain context